Overview

overview

10

Static

static

10

2to1ep.exe

windows10-2004-x64

10

2to1ep.exe

windows11-ltsc_2024-x64

10

4363463463...63.exe

windows10-2004-x64

10

4363463463...63.exe

windows11-ltsc_2024-x64

10

Synaptics.exe

windows10-2004-x64

10

Synaptics.exe

windows11-ltsc_2024-x64

10

TsarBomba.exe

windows10-2004-x64

TsarBomba.exe

windows11-ltsc_2024-x64

10

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-ltsc_2024-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-ltsc_2024-x64

10

random.exe

windows10-2004-x64

10

random.exe

windows11-ltsc_2024-x64

10

Resubmissions

30/08/2026, 18:07

260830-wqdtasyxd110

15/08/2026, 20:51

260815-zm6lpahf93

15/08/2026, 20:41

260815-zgvbgagm7y

14/08/2026, 22:57

260814-2w7w8aar3y

14/08/2026, 11:48

260814-nyhs8aszbx10

14/08/2026, 04:14

260814-ett61svse110

14/08/2026, 04:07

260814-epvlzscl7y

09/08/2026, 10:54

260809-mzv99sztc1

09/08/2026, 10:54

260809-mzk5aswfjg

09/08/2026, 10:47

260809-mv1desdp6x

Analysis

  • max time kernel
    58s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 22:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample260806-1x9xjacd96
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareee24521c6a3a8dc1be6736334f3e1620livetraffoctrupashotdefense_evasiondiscoverydownloaderexecutionkoiloadernjratphorphiexquasarredlinesolaris_loadersvcstealervidarinfostealerinstallerloaderpersistenceprivilege_escalationpyinstallerransomwarerevoked_codesignspywarestealertrojanworm

Malware Config

Extracted

Family

  • solaris_loader

C2

  • 196.251.107.186

  • 192.162.199.186

  • 196.251.107.163

Extracted

Family

  • njrat

Version

  • im523

Botnet

  • TrupAshot

C2

  • documents-elegant.at.ply.gg:54835

Mutex

  • 4a87b5397a2736773782f50e108b2da4

Attributes
  • reg_key

    4a87b5397a2736773782f50e108b2da4

  • splitter

    |'|'|

Extracted

Family

  • vidar

Version

  • 2.6

Botnet

  • ee24521c6a3a8dc1be6736334f3e1620

C2

  • https://sot.tbo88men.top

  • https://t.me/np33yk

  • https://steamcommunity.com/profiles/76561198671804195

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Extracted

Family

  • quasar

Attributes
  • encryption_key

    AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • reconnect_delay

    3000

Extracted

Family

  • koiloader

C2

  • http://5.101.82.4/sparkles.php

Attributes
  • payload_url

    https://kavacanada.ca/catalog/model

Extracted

Family

  • phorphiex

C2

  • http://178.16.54.109

Extracted

Family

  • redline

Botnet

  • LiveTraffoc

C2

  • 4.185.56.82:42687

Signatures

  • Family: KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader
  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: SolarisLoader

    SolarisLoader is a Windows loader written in C.

    loadersolaris_loader
  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Detects KoiLoader payload 1 IoCs
    loader
  • Detects SvcStealer Payload 3 IoCs

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Quasar payload 2 IoCs
  • RedLine payload 1 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 18 IoCs
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 1 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 40 IoCs
  • Detects Pyinstaller 3 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 58 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:4404
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:4452
      • C:\Windows\system32\ctfmon.exe
        /QuitInfo:0000000000000268;000000000000026C;
        1⤵
          PID:4980
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5372
            • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
              "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
              3⤵
              • Downloads MZ/PE file
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5984
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                4⤵
                  PID:3572
                • C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5700
                  • C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2412
                • C:\Users\Admin\AppData\Local\Temp\Files\Bugsoft.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Bugsoft.exe"
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4440
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
                    5⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    PID:5756
                • C:\Users\Admin\AppData\Local\Temp\Files\bot_x64.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\bot_x64.exe"
                  4⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5236
                • C:\Users\Admin\AppData\Local\Temp\Files\444.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\444.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1116
                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5864
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 880
                      6⤵
                      • Program crash
                      PID:5796
                • C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Modifies Internet Explorer start page
                  • Suspicious use of SetWindowsHookEx
                  PID:5116
                • C:\Users\Admin\AppData\Local\Temp\Files\db9c0fee.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\db9c0fee.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3340
                • C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4472
                  • C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1076
                    • C:\Users\Admin\AppData\Local\Temp\tmp4cbecqsy\xena.exe
                      C:\Users\Admin\AppData\Local\Temp\tmp4cbecqsy\xena.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:3624
                      • C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\RandomError.exe
                        "C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\RandomError.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1788
                        • C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\RandomError.exe
                          "C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\RandomError.exe"
                          8⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:3452
                      • C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\9s07g59jj323w77x.exe
                        "C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\9s07g59jj323w77x.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2384
                • C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:6068
                  • C:\Users\Admin\AppData\Local\Temp\is-CJE8O.tmp\safman_setup.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-CJE8O.tmp\safman_setup.tmp" /SL5="$80216,8627077,790528,C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2292
                • C:\Users\Admin\AppData\Local\Temp\Files\M64.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3484
                • C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious behavior: AddClipboardFormatListener
                  PID:2740
                • C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5008
                • C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
                  4⤵
                  • Manipulates Digital Signatures
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious use of WriteProcessMemory
                  PID:3964
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                    5⤵
                    • Modifies registry class
                    PID:5684
                • C:\Users\Admin\AppData\Local\Temp\Files\cummersMG.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\cummersMG.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4492
                • C:\Users\Admin\AppData\Local\Temp\Files\32.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\32.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:912
                • C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3276
                  • C:\Windows\SysWOW64\msiexec.exe
                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\522b79fad9610535\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
                    5⤵
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:1616
                • C:\Users\Admin\AppData\Local\Temp\Files\njrat.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\njrat.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1868
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                    dw20.exe -x -s 980
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4764
                • C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4176
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3932
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 344
                    5⤵
                    • Program crash
                    PID:2744
                • C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:1752
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd /c "Serials_Checker.bat"
                    5⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:3716
                    • C:\Windows\system32\mode.com
                      mode con: cols=90 lines=48
                      6⤵
                        PID:1320
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic bios get serialnumber
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2832
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic csproduct get uuid
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4956
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic cpu get serialnumber
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5100
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic cpu get processorid
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1424
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic diskdrive get serialnumber
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5920
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic baseboard get serialnumber
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6060
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic memorychip get serialnumber
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1984
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3756
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic PATH Win32_VideoController GET Description,PNPDeviceID
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4860
                • C:\Users\Admin\AppData\Local\Temp\sjgxwhgh.exe
                  "C:\Users\Admin\AppData\Local\Temp\sjgxwhgh.exe"
                  3⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:792
                  • C:\Users\Admin\AppData\Local\Temp\3mpr7c4j.exe
                    "C:\Users\Admin\AppData\Local\Temp\3mpr7c4j.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2132
                    • C:\Windows\helpPane.exe
                      "C:\Windows\helpPane.exe"
                      5⤵
                        PID:1760
                    • C:\Users\Admin\AppData\Local\Temp\8audd9y3.exe
                      "C:\Users\Admin\AppData\Local\Temp\8audd9y3.exe"
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1208
                    • C:\Windows\system32\notepad.exe
                      "C:\Windows\system32\notepad.exe"
                      4⤵
                        PID:2744
                  • C:\Users\Admin\AppData\Local\Temp\yhqnilub.exe
                    "C:\Users\Admin\AppData\Local\Temp\yhqnilub.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:5792
                • C:\Windows\System32\smartscreen.exe
                  C:\Windows\System32\smartscreen.exe -Embedding
                  1⤵
                    PID:3388
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1504
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6040
                  • C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
                    "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
                    1⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:5228
                  • C:\Windows\KdzEregli.exe
                    C:\Windows\KdzEregli.exe
                    1⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1268
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5864 -ip 5864
                    1⤵
                      PID:2124
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4544
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Enumerates connected drives
                      • Boot or Logon Autostart Execution: Authentication Package
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:244
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding C1108E027AEDC761DEF985BAFEDA6B1B C
                        2⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4952
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE015.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240771234 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5872
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE287.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240771734 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
                          3⤵
                          • Badlisted process makes network request
                          • System Location Discovery: System Language Discovery
                          PID:2868
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE7A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240773109 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1988
                      • C:\Windows\system32\srtasks.exe
                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                        2⤵
                          PID:2860
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding F481068B9617237F97D7E684EA4B7252
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3460
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding FBCF9B48B74F3AFA4FC86D0FD6A40F89 E Global\MSI0000
                          2⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:5416
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4176 -ip 4176
                        1⤵
                          PID:6060
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:3224
                        • C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.ClientService.exe
                          "C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-im4ma2-relay.screenconnect.com&p=443&s=c8590a86-c6e6-4348-8563-8162932edcae&k=BgIAAACkAABSU0ExAAgAAAEAAQDlA4l2eTHU2yyYo2Lb7YqRpEyahXHp0b96yXusH4FHjSypI2b%2fFHPQBisPe3pfaUd3lmqoN0QlL5EJzsR3zury%2fU8nC19lh7G1vQDAgPjUl9UDlPRZSUupDUN3nADR9%2b5lHfTIRbU8HdGiqszKtVmDggODxT5vPoKFscNvgoEyVUHayU6wWbEbLEAP0t9uhXxJcjM%2bUHpQkF7jKJY08qt5qrAu6zS%2bYH0kjxFuMaEIiSW7pCGjhFRCUKKlbFCBZ8UCEO5JCMBD9kjGV7d1HM5tQ8e%2b7TihhbKfcLxb2yg1vlURP32867SVxkDGHAD11zGeglmh%2bm8pkhxYRZeN5N2l"
                          1⤵
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          PID:5184
                          • C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.WindowsClient.exe
                            "C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.WindowsClient.exe" "RunRole" "f985b300-c264-49a8-9699-d55bd7bbd5ea" "User"
                            2⤵
                              PID:1316
                            • C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.WindowsClient.exe
                              "C:\Program Files (x86)\ScreenConnect Client (522b79fad9610535)\ScreenConnect.WindowsClient.exe" "RunRole" "fb5bc75a-f9b6-42eb-bea4-42c1075175e0" "System"
                              2⤵
                                PID:5916

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  Windows Command Shell

                                  1
                                  T1059.003

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  3
                                  T1547

                                  Authentication Package

                                  1
                                  T1547.002

                                  Registry Run Keys / Startup Folder

                                  2
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  3
                                  T1547

                                  Authentication Package

                                  1
                                  T1547.002

                                  Registry Run Keys / Startup Folder

                                  2
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Defense Evasion

                                  Modify Registry

                                  5
                                  T1112

                                  Subvert Trust Controls

                                  2
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  SIP and Trust Provider Hijacking

                                  1
                                  T1553.003

                                  Credential Access

                                  Discovery

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  5
                                  T1012

                                  System Information Discovery

                                  5
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  e5a33c4.rbs
                                  • Path C:\Config.Msi\e5a33c4.rbs
                                  • Size 214KB
                                  • SHA256 b2c3090ace11c0b9d55e8e699956ca939a27bf90707a8c66d129b3523b597981
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  3mpr7c4j.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\3mpr7c4j.exe
                                  • Size 3.7MB
                                  • SHA256 18df0ec2efba162d1774b1bf2233c2c24934d2bda49769e814f24d530a795c38
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  8audd9y3.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\8audd9y3.exe
                                  • Size 321KB
                                  • SHA256 261e32f7edb1e80f7c2e64d0815b7e3aa430d4c6f287347f513bc00d4a519980
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  32.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\32.exe
                                  • Size 12KB
                                  • SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  444.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\444.exe
                                  • Size 37KB
                                  • SHA256 9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Amus.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe
                                  • Size 50KB
                                  • SHA256 b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Bugsoft.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Bugsoft.exe
                                  • Size 32KB
                                  • SHA256 96425ae53a5517b9f47e30f6b41fdc883831039e1faba02fe28b2d5f3efcdc29
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CFXBypass.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
                                  • Size 36KB
                                  • SHA256 2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  M64.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\M64.exe
                                  • Size 254KB
                                  • SHA256 a30a5b326aed3931627b737eba7fad9dc945d6c9df600219264a7c795c152b0d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Pulsar-Client.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe
                                  • Size 955KB
                                  • SHA256 58482050ff75fc1fd60a2b6e23180dbf5ea12a40fb69eb1cdfd3f19d6e8a0a33
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RedLineStealer.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe
                                  • Size 512KB
                                  • SHA256 071b6c448d2546dea8caed872fca0d002f59a6b9849f0de2a565fc74b487fa37
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ScreenConnect.ClientSetup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                                  • Size 12.2MB
                                  • SHA256 48313342aac1bcb0a7a6dbae54dc59a76c796da083d8d5299719876470c1668b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Serials_Checker.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
                                  • Size 156KB
                                  • SHA256 5541c5c5a62d4bfa83b4e1f1202d9cedbb1c9c642daeaa470fe6d1c1fbb37551
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  bot_x64.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\bot_x64.exe
                                  • Size 57KB
                                  • SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  cummersMG.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\cummersMG.exe
                                  • Size 272KB
                                  • SHA256 d1f32be6a9d1bfdc0489d06224b16d99aaa641d9e7dc6faad142bde79eb09e1e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  darts-wled.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\darts-wled.exe
                                  • Size 7.7MB
                                  • SHA256 dcb20b82ed03b1a91fe18b0c4011bf382e1cb46a79324f9e725ec309010d93cc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  db9c0fee.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\db9c0fee.exe
                                  • Size 1.0MB
                                  • SHA256 b7fd8d6dddf0e4321dd5303ecd50d4a9d833ab4a80e0a01face12116363a8103
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  njrat.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\njrat.exe
                                  • Size 213KB
                                  • SHA256 0c428e4211424a0f7cfb8e720fffc62b56c6e0334bcf394f49d235cab6ba5b50
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  safman_setup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
                                  • Size 9.1MB
                                  • SHA256 d181fee3f2493b3e81b0b678f040ec619b041973b567c96cd5a7b543abedbe1a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  support.client.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
                                  • Size 305KB
                                  • SHA256 6ff59d49647c897e8c134519f5eb73ff53bd55386a24c55058e7427598d5a754
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  xeno.V1.3.55.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe
                                  • Size 27.9MB
                                  • SHA256 7b41176a3275bc7a1c43f5be0a984ab477b926616bc9c2ef753be7cde0d63c45
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CustomAction.config
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE287.tmp-\CustomAction.config
                                  • Size 234B
                                  • SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Microsoft.Deployment.WindowsInstaller.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE287.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                  • Size 172KB
                                  • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ScreenConnect.Core.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE287.tmp-\ScreenConnect.Core.dll
                                  • Size 567KB
                                  • SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ScreenConnect.InstallerActions.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE287.tmp-\ScreenConnect.InstallerActions.dll
                                  • Size 24KB
                                  • SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  MSIE7A9.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE7A9.tmp
                                  • Size 1.1MB
                                  • SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ScreenConnect.Windows.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE7A9.tmp-\ScreenConnect.Windows.dll
                                  • Size 1.7MB
                                  • SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ScreenConnect.WindowsInstaller.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIE7A9.tmp-\ScreenConnect.WindowsInstaller.dll
                                  • Size 137KB
                                  • SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Tmp2B1.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\Tmp2B1.tmp
                                  • Size 2KB
                                  • SHA256 cb7c473f986fe33251a9c88280c261ca4ee46bb102c7cdbc2021476a8e8b6a0e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  VCRUNTIME140.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\VCRUNTIME140.dll
                                  • Size 93KB
                                  • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _bz2.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\_bz2.pyd
                                  • Size 85KB
                                  • SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _ctypes.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\_ctypes.pyd
                                  • Size 124KB
                                  • SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _lzma.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\_lzma.pyd
                                  • Size 159KB
                                  • SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-console-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-console-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-datetime-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-datetime-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-debug-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-debug-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-errorhandling-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-errorhandling-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-fibers-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-fibers-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-fibers-l1-1-1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-fibers-l1-1-1.dll
                                  • Size 21KB
                                  • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-file-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-file-l1-1-0.dll
                                  • Size 25KB
                                  • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-file-l1-2-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-file-l1-2-0.dll
                                  • Size 21KB
                                  • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-file-l2-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-file-l2-1-0.dll
                                  • Size 21KB
                                  • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-handle-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-handle-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-heap-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-heap-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-interlocked-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-interlocked-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                  • Size 21KB
                                  • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-libraryloader-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-libraryloader-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-localization-l1-2-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-localization-l1-2-0.dll
                                  • Size 21KB
                                  • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-memory-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-memory-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-namedpipe-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-namedpipe-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-processenvironment-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-processenvironment-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-processthreads-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-processthreads-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-processthreads-l1-1-1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-processthreads-l1-1-1.dll
                                  • Size 21KB
                                  • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-profile-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-profile-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-rtlsupport-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-rtlsupport-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-string-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-string-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-synch-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-synch-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-synch-l1-2-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-synch-l1-2-0.dll
                                  • Size 21KB
                                  • SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-sysinfo-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-sysinfo-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-sysinfo-l1-2-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-sysinfo-l1-2-0.dll
                                  • Size 21KB
                                  • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-timezone-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-timezone-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-core-util-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-core-util-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-conio-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-conio-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-convert-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-convert-l1-1-0.dll
                                  • Size 25KB
                                  • SHA256 ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-environment-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-environment-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-filesystem-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-filesystem-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-heap-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-heap-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-locale-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-locale-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-math-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-math-l1-1-0.dll
                                  • Size 29KB
                                  • SHA256 606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-process-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-process-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-runtime-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-runtime-l1-1-0.dll
                                  • Size 25KB
                                  • SHA256 c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-stdio-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-stdio-l1-1-0.dll
                                  • Size 25KB
                                  • SHA256 a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-string-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-string-l1-1-0.dll
                                  • Size 25KB
                                  • SHA256 25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-time-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-time-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  api-ms-win-crt-utility-l1-1-0.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\api-ms-win-crt-utility-l1-1-0.dll
                                  • Size 21KB
                                  • SHA256 d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  base_library.zip
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\base_library.zip
                                  • Size 824KB
                                  • SHA256 7c1c73de4909d11efb20028f4745a9c8494fb4ee8dcf2f049907115def3d2629
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libcrypto-1_1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\libcrypto-1_1.dll
                                  • Size 3.2MB
                                  • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libffi-7.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\libffi-7.dll
                                  • Size 32KB
                                  • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libssl-1_1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\libssl-1_1.dll
                                  • Size 674KB
                                  • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  python38.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\python38.dll
                                  • Size 4.0MB
                                  • SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ucrtbase.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI57002\ucrtbase.dll
                                  • Size 1.3MB
                                  • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  9s07g59jj323w77x.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\9s07g59jj323w77x.exe
                                  • Size 682KB
                                  • SHA256 29c1834c657de2c631cc17a80b8b9b271860308a15383dadcb0387f5798b17d8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RandomError.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\bnd_f954ef70\RandomError.exe
                                  • Size 11.9MB
                                  • SHA256 2839188cb007b54efac1a57d4f5aee6addf9a2a46ed176908aa61b5b11f84aa7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  e5a33c5.msi
                                  • Path C:\Windows\Installer\e5a33c5.msi
                                  • Size 9.8MB
                                  • SHA256 2ebdabe38f43b20d6cea3dd4b1cae93f605f8c4d5259bc9d6e9be8974c4623d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  erhmaigu.newcfg
                                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (522b79fad9610535)\erhmaigu.newcfg
                                  • Size 881B
                                  • SHA256 a6099f0d8021a74ba852769fc8e10bd8a21c6937001bbe382419283e3caebcf4
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tigcmno0.newcfg
                                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (522b79fad9610535)\tigcmno0.newcfg
                                  • Size 683B
                                  • SHA256 4811423538222e5bcfd1040dcc4ea373e5182c2852d342f2ec6a6f2d6bbbce1c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  user.config
                                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (522b79fad9610535)\user.config
                                  • Size 520B
                                  • SHA256 c00427095fa245a6e1923d570223caad7c85677a19bffd4ad4c0810584b3d618
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  memory/800-171-0x0000013678AB0000-0x0000013678AB7000-memory.dmp
                                  Download

                                  memory/1208-1750-0x0000000000390000-0x00000000003E4000-memory.dmp
                                  Download

                                  memory/1208-1751-0x00000000025D0000-0x00000000025E8000-memory.dmp
                                  Download

                                  memory/1208-1764-0x0000000005390000-0x00000000053F6000-memory.dmp
                                  Download

                                  memory/1208-1752-0x0000000004D60000-0x0000000004DAC000-memory.dmp
                                  Download

                                  memory/1268-236-0x0000000000400000-0x000000000040E000-memory.dmp
                                  Download

                                  memory/1316-1828-0x0000000000120000-0x00000000001CE000-memory.dmp
                                  Download

                                  memory/1316-1830-0x0000000002450000-0x00000000024E4000-memory.dmp
                                  Download

                                  memory/1316-1844-0x0000000000950000-0x000000000096A000-memory.dmp
                                  Download

                                  memory/1316-1843-0x000000001B490000-0x000000001B640000-memory.dmp
                                  Download

                                  memory/1316-1829-0x0000000000B30000-0x0000000000B9C000-memory.dmp
                                  Download

                                  memory/1760-1486-0x00007FF7876D0000-0x00007FF787920000-memory.dmp
                                  Download

                                  memory/1760-1497-0x00007FF7876D0000-0x00007FF787920000-memory.dmp
                                  Download

                                  memory/1760-1492-0x00007FF7876D0000-0x00007FF787920000-memory.dmp
                                  Download

                                  memory/1868-1595-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1607-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1584-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1591-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1575-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1576-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1577-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1579-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1596-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1594-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1597-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1598-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1599-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1601-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1603-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1602-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1604-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1605-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1555-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1600-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1592-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1612-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1606-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1593-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1608-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1578-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1580-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1581-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1582-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1583-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1585-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1586-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1587-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1588-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1590-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1589-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1611-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1610-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/1868-1609-0x0000000000780000-0x00000000007A6000-memory.dmp
                                  Download

                                  memory/2292-1530-0x0000000000400000-0x000000000070A000-memory.dmp
                                  Download

                                  memory/2384-632-0x000001CAE2950000-0x000001CAE29FC000-memory.dmp
                                  Download

                                  memory/2740-1468-0x000001D753EF0000-0x000001D753F24000-memory.dmp
                                  Download

                                  memory/2740-1466-0x000001D753970000-0x000001D753A64000-memory.dmp
                                  Download

                                  memory/2740-1509-0x000001D76F2C0000-0x000001D76F2FE000-memory.dmp
                                  Download

                                  memory/2868-1694-0x00000000053F0000-0x0000000005418000-memory.dmp
                                  Download

                                  memory/3276-1542-0x0000000006220000-0x00000000063D0000-memory.dmp
                                  Download

                                  memory/3276-1541-0x0000000003B20000-0x0000000003B48000-memory.dmp
                                  Download

                                  memory/3276-1540-0x0000000006140000-0x00000000061D4000-memory.dmp
                                  Download

                                  memory/3276-1539-0x0000000003AF0000-0x0000000003AFC000-memory.dmp
                                  Download

                                  memory/3276-1538-0x0000000003AD0000-0x0000000003AD8000-memory.dmp
                                  Download

                                  memory/3276-1543-0x0000000006990000-0x0000000006F4A000-memory.dmp
                                  Download

                                  memory/3452-1547-0x00007FF8669F0000-0x00007FF866A19000-memory.dmp
                                  Download

                                  memory/3624-424-0x00000000003C0000-0x0000000001052000-memory.dmp
                                  Download

                                  memory/3932-1731-0x0000000006A00000-0x0000000006A12000-memory.dmp
                                  Download

                                  memory/3932-1708-0x0000000000400000-0x0000000000450000-memory.dmp
                                  Download

                                  memory/3932-1710-0x0000000004FC0000-0x0000000004FCA000-memory.dmp
                                  Download

                                  memory/3932-1730-0x0000000006A20000-0x0000000006B2A000-memory.dmp
                                  Download

                                  memory/3932-1732-0x0000000006B70000-0x0000000006BAC000-memory.dmp
                                  Download

                                  memory/3932-1728-0x0000000006C80000-0x0000000007298000-memory.dmp
                                  Download

                                  memory/3932-1733-0x0000000006BC0000-0x0000000006C0C000-memory.dmp
                                  Download

                                  memory/3932-1709-0x0000000004FE0000-0x0000000005072000-memory.dmp
                                  Download

                                  memory/4404-161-0x000001D3CE750000-0x000001D3CE753000-memory.dmp
                                  Download

                                  memory/4404-167-0x000001D3CF1B0000-0x000001D3CF1B7000-memory.dmp
                                  Download

                                  memory/4404-384-0x000001D3CFBE0000-0x000001D3CFBE2000-memory.dmp
                                  Download

                                  memory/4452-169-0x000001B9DCCB0000-0x000001B9DCCB7000-memory.dmp
                                  Download

                                  memory/4492-1517-0x0000000000FB0000-0x0000000000FBD000-memory.dmp
                                  Download

                                  memory/4980-387-0x0000000180000000-0x0000000180005000-memory.dmp
                                  Download

                                  memory/5008-1481-0x0000000000A80000-0x0000000000A90000-memory.dmp
                                  Download

                                  memory/5008-1484-0x000000001B7A0000-0x000000001B7C2000-memory.dmp
                                  Download

                                  memory/5116-188-0x0000000000400000-0x000000000040E000-memory.dmp
                                  Download

                                  memory/5116-1868-0x0000000000400000-0x000000000040E000-memory.dmp
                                  Download

                                  memory/5184-1809-0x0000000003FE0000-0x0000000004030000-memory.dmp
                                  Download

                                  memory/5184-1825-0x00000000042A0000-0x000000000430C000-memory.dmp
                                  Download

                                  memory/5184-1826-0x0000000004030000-0x0000000004071000-memory.dmp
                                  Download

                                  memory/5184-1827-0x0000000004500000-0x00000000045D6000-memory.dmp
                                  Download

                                  memory/5184-1797-0x00000000040F0000-0x00000000042A0000-memory.dmp
                                  Download

                                  memory/5184-1796-0x0000000003E90000-0x0000000003F24000-memory.dmp
                                  Download

                                  memory/5184-1795-0x0000000003DD0000-0x0000000003DEA000-memory.dmp
                                  Download

                                  memory/5228-218-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                  Download

                                  memory/5228-223-0x00007FF842450000-0x00007FF842460000-memory.dmp
                                  Download

                                  memory/5228-221-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                  Download

                                  memory/5228-220-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                  Download

                                  memory/5228-219-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                  Download

                                  memory/5228-217-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                  Download

                                  memory/5228-224-0x00007FF842450000-0x00007FF842460000-memory.dmp
                                  Download

                                  memory/5372-165-0x0000000003BE0000-0x0000000003BE7000-memory.dmp
                                  Download

                                  memory/5372-185-0x0000000003C00000-0x0000000003C01000-memory.dmp
                                  Download

                                  memory/5372-408-0x00000000014A0000-0x00000000014A1000-memory.dmp
                                  Download

                                  memory/5372-225-0x0000000003C10000-0x0000000003C11000-memory.dmp
                                  Download

                                  memory/5684-1506-0x000001CD018A0000-0x000001CD018A8000-memory.dmp
                                  Download

                                  memory/5684-1507-0x000001CD1BEE0000-0x000001CD1C068000-memory.dmp
                                  Download

                                  memory/5872-1662-0x0000000005B60000-0x0000000005BF4000-memory.dmp
                                  Download

                                  memory/5872-1666-0x0000000005DB0000-0x0000000005F60000-memory.dmp
                                  Download

                                  memory/5872-1660-0x0000000005AA0000-0x0000000005AAC000-memory.dmp
                                  Download

                                  memory/5872-1658-0x0000000005A60000-0x0000000005A8E000-memory.dmp
                                  Download

                                  memory/5984-0-0x0000000075072000-0x0000000075073000-memory.dmp
                                  Download

                                  memory/5984-235-0x0000000075060000-0x000000007581C000-memory.dmp
                                  Download

                                  memory/5984-222-0x0000000075072000-0x0000000075073000-memory.dmp
                                  Download

                                  memory/5984-3-0x0000000075060000-0x000000007581C000-memory.dmp
                                  Download

                                  memory/5984-2-0x0000000005750000-0x00000000057EC000-memory.dmp
                                  Download

                                  memory/5984-1-0x0000000000DA0000-0x0000000000DA8000-memory.dmp
                                  Download

                                  memory/6068-418-0x0000000000400000-0x00000000004CE000-memory.dmp
                                  Download

                                  memory/6068-1528-0x0000000000400000-0x00000000004CE000-memory.dmp
                                  Download