e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f

Analysis

max time kernel
152s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToDesk_x64_5.exe
Size 122.6MB
Sample261110-v8e9eahd76
SHA256 e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f
MD5 1bc37b70ca2c76608717e83f6619e68b
SHA1 addeb76b032bec535981edfe73a481d1d49707bb
SHA512 69a3e71f4a77170eb8da3117fec2b241fa082cf51fe3e0ddb4d8d04255052f7d1abe27022d70171e9a3505ac298fb9a78ef3e6dbc013a4d18da7acf53ab40416
SSDEEP 3145728:tdvGTxpP59WydHJw3hNT129VuU5VaB2XDom6jg:tYTxV59H8hNxg5hxB
TLSH
T18E583321E351C074F15602B0E4AA1BBF4E3E7E748B2990D35BF07E1AB9316C1AB39759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2624 created 5700	2624	elevation_service.exe	81

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3260	attrib.exe
3256	attrib.exe

Executes dropped EXE 7 IoCs

pid	Process
2352	ToDesk_x64_5.tmp
1604	Swearflesh6239.exe
2044	installer.exe
6120	Swearflesh6239.exe
5188	Swearflesh6239.exe
2316	Swearflesh6239.exe
3900	Swearflesh6239.exe

Loads dropped DLL 5 IoCs

pid	Process
1604	Swearflesh6239.exe
6120	Swearflesh6239.exe
5188	Swearflesh6239.exe
2316	Swearflesh6239.exe
3900	Swearflesh6239.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2728	icacls.exe
2520	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3216	cmd.exe
1580	cmd.exe
5996	cmd.exe
5232	cmd.exe
5640	cmd.exe
4728	cmd.exe
5368	cmd.exe
1564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_x64_5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_x64_5.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1076-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/memory/1076-58-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	55	Go-http-client/1.1
HTTP User-Agent header	199	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4624	taskkill.exe
4732	taskkill.exe
4104	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2352	ToDesk_x64_5.tmp
2352	ToDesk_x64_5.tmp
1604	Swearflesh6239.exe
1604	Swearflesh6239.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
2624	elevation_service.exe
684	waitfor.exe
684	waitfor.exe
6120	Swearflesh6239.exe
6120	Swearflesh6239.exe
5188	Swearflesh6239.exe
5188	Swearflesh6239.exe
2316	Swearflesh6239.exe
2316	Swearflesh6239.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1604	Swearflesh6239.exe
2624	elevation_service.exe
2624	elevation_service.exe
6120	Swearflesh6239.exe
5188	Swearflesh6239.exe
2316	Swearflesh6239.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	1604	Swearflesh6239.exe
Token: SeShutdownPrivilege	2624	elevation_service.exe
Token: SeShutdownPrivilege	684	waitfor.exe
Token: SeDebugPrivilege	684	waitfor.exe
Token: SeDebugPrivilege	684	waitfor.exe
Token: SeDebugPrivilege	8	whoami.exe
Token: SeBackupPrivilege	5520	vssvc.exe
Token: SeRestorePrivilege	5520	vssvc.exe
Token: SeAuditPrivilege	5520	vssvc.exe
Token: SeDebugPrivilege	6120	Swearflesh6239.exe
Token: SeDebugPrivilege	5188	Swearflesh6239.exe
Token: SeDebugPrivilege	2316	Swearflesh6239.exe
Token: SeDebugPrivilege	3900	Swearflesh6239.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	ToDesk_x64_5.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
684	waitfor.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2352	1076	ToDesk_x64_5.exe	89
PID 2352 wrote to memory of 4624	2352	ToDesk_x64_5.tmp	90
PID 2352 wrote to memory of 4732	2352	ToDesk_x64_5.tmp	93
PID 2352 wrote to memory of 4104	2352	ToDesk_x64_5.tmp	95
PID 2352 wrote to memory of 1604	2352	ToDesk_x64_5.tmp	97
PID 2352 wrote to memory of 2044	2352	ToDesk_x64_5.tmp	98
PID 2624 wrote to memory of 5232	2624	elevation_service.exe	102
PID 5232 wrote to memory of 684	5232	cmd.exe	104
PID 2624 wrote to memory of 5640	2624	elevation_service.exe	105
PID 5640 wrote to memory of 2728	5640	cmd.exe	107
PID 2624 wrote to memory of 4728	2624	elevation_service.exe	108
PID 684 wrote to memory of 1472	684	waitfor.exe	110
PID 4728 wrote to memory of 2520	4728	cmd.exe	111
PID 2624 wrote to memory of 3256	2624	elevation_service.exe	112
PID 2624 wrote to memory of 3260	2624	elevation_service.exe	114
PID 2624 wrote to memory of 4392	2624	elevation_service.exe	116
PID 684 wrote to memory of 6108	684	waitfor.exe	118
PID 684 wrote to memory of 5368	684	waitfor.exe	121
PID 5368 wrote to memory of 3632	5368	cmd.exe	122
PID 5368 wrote to memory of 8	5368	cmd.exe	123
PID 1564 wrote to memory of 6120	1564	cmd.exe	128
PID 3216 wrote to memory of 5188	3216	cmd.exe	131
PID 1580 wrote to memory of 2316	1580	cmd.exe	136
PID 5996 wrote to memory of 3900	5996	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3260	attrib.exe
3256	attrib.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5700
- C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe
  "C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\is-23II6.tmp\ToDesk_x64_5.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-23II6.tmp\ToDesk_x64_5.tmp" /SL5="$400A8,128188387,119296,C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4624
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4104
  - - C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
      "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Drivers\Horriblegraded4873\installer.exe
      "C:\Drivers\Horriblegraded4873\installer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2044
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:1472
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:6108
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3632
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:2728
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:2520
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3256
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3260
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn lJPONUHlyagxOaTUDWewUfrr /tr "cmd /c cd /d \"C:\Drivers\RecipesConfirmed\" && start \"\" \"C:\Drivers\RecipesConfirmed\Swearflesh6239.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4392

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:5388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:6120

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5188

C:\Windows\system32\schtasks.exe
schtasks /query /tn lJPONUHlyagxOaTUDWewUfrr
1⤵
PID:2968

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

C:\Windows\system32\schtasks.exe
schtasks /query /tn lJPONUHlyagxOaTUDWewUfrr
1⤵
PID:3576

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

analiz.mp4

Path C:\Drivers\Horriblegraded4873\analiz.mp4
Size 34.7MB
SHA256 e2707ac041c08da9904c2dfae282acbaf3f9597b37ebbde2363d87248ce7b06d
MD5 4a9b6121bee654f961b66080ca8851c2
SHA1 0736783d9c4ee2ae1dcd9d7ab1c6067dea64db6e
SHA512 1f7a6668b2e8a44c1d6bb89a7d48e883946e0bc6e6abff16c88c3a41107efde6564cb14cde340a2a94e5af7395970cb017049154c61cb84de7865ad97cbb87b3
SSDEEP 786432:Joz1X3u3uq1pLJoxf4bJsSX+U7v7DFpPL9HNXFJPDdQffZb9j:JoZX3u+qyGsSX/rFpPJHNHLiZb9j
TLSH
T1A3873378D2B49645E221B3B0BDC9325F0F3F2BC2851D62D859B6F34BE168840DAF5D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gruppirovka.png

Path C:\Drivers\Horriblegraded4873\gruppirovka.png
Size 17.5MB
SHA256 448a0d9eb786ea1a3b39c9a250f69104dea61471bae77ea4c24a239293697c35
MD5 dc87bbd830b4a868b37bc791b962f667
SHA1 215f6767e5fccb66bb19b954ec0d8ec1f57e2c97
SHA512 2e1802d97aaaa796db27f1304c802aa3e297703961b033d079f4817e02dd38385daefd951d88cfbe9ac70e59dc56082cf853fd4004760e79bc6abb69033b30c2
SSDEEP 393216:XjpLum1hKA5FUqTgKnt1pwIFyt23UB7vUW3Hxq6isNJSUD6Kd2Ntc:zBu6B5FUqjnNuB7R3R2QJl07c
TLSH
T16E073338C4E45644F4371D07506F2314B4BEF3D6AA61843ABCEBE1416BA2D5CA9BF9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Drivers\Horriblegraded4873\installer.exe
Size 3.9MB
SHA256 96e3691705e719a96abfc429ccde507321ac0c17534d54171fe0ce47a186e7cd
MD5 e77228a3deaa73ce637d81fcb8140bf0
SHA1 bc0ca62a89e66a38e159bf5d75514a6d1b905532
SHA512 4921ed7b29bc7b6851d097883db7b7756d29ed244542ce29c8d63a52630d221f4321dba2b6ade455b21bc62d22a3d4198bd449c4397d55861c2afb4137f8f05d
SSDEEP 98304:1kvcCPsKRH3AV1qtMDC7/b1VkK655XqJ3eJeVylAEI:qcCkmvpJVkRWJ3eJKH
TLSH
T14616CF12F641C0B1E48201B1D17A9BFB8A3E9D34D73A99C3D7D03D65B9312C2673A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-88V07.tmp

Path C:\Drivers\Horriblegraded4873\is-88V07.tmp
Size 32.9MB
SHA256 934c01231fa7ce1889be5f7d27fd1a7581f9a59de0989a8fbe2a3175abc4a757
MD5 5021c78e0d222262e75bcdb5caf7db04
SHA1 f9b894bc8835e2a35141841822e7777430e38890
SHA512 c664eecc3ceeced33f58574a5c8171fdf7d906b68b791a405bd2f61bf7bb78f3dfc0b4313f5e328778230e5d67ebcaf749d0a21e465d8778ddd75c7fd0966a92
SSDEEP 786432:GrmMOL6EXVU5NfxYaJQQvT2DlZxH/8CG5XCR+D1mFvCKvpd12U1gJv:GI6WyDxtJQQKldL5FvNT129v
TLSH
T13877336C43B1720DF27963B564C6276E462E33EE4E1D71A414783382E2AE650F7F8279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skript.mp3

Path C:\Drivers\Horriblegraded4873\skript.mp3
Size 2.1MB
SHA256 2195d02466fdaaefd9edcb02e9721e98f4923efb93646ae55357a14024f632c8
MD5 7f12dcb0528ed34a7e2beb4ad3ba08a5
SHA1 13ec87c6a8d58af32aee54bbc994df08fa302f8a
SHA512 58b7be220ee7c6ac6c5c124d629141cafec3ff0ab4b7ae701d78977a4e62bb5145ad6aa02e8dec7ea1c2e65278e9cfc7986c1fc099c910ca3b25e87595e93907
SSDEEP 49152:tlxVqav6abbQSqCWHQlJrJemi+o+6PQrXSGe0SUCdnh:xVqav6gbuwlJrJDi+eGe0ni
TLSH
T1FBA5338D476CD04BF6BCBFF4FEC05C9DD87E292B96A4F10129B97B0250D21A719278A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spisok.mp3

Path C:\Drivers\Horriblegraded4873\spisok.mp3
Size 2.4MB
SHA256 c4b28fa7f9b5fe86b9d62fd01597762455794e2215bbaf6827a02cf19f15d6e3
MD5 0476d6edec28e0c0e5c4b1ed901ad039
SHA1 72522ee6d260660e0cc9ccebb47952848698c72e
SHA512 a113a53f8bc82c2fdf90c4617af27a1a547cf8f328c1fdce2f161665ba0c5fdc2d785e531cd54d7656ebd8c1f93e0df8b5fe767157872911d9656120746bfa30
SSDEEP 49152:e9hInt7PqhMpGOLpjEl1eq0+HVeYlHPJvNpeZqdwjzh3G7lnJDwdV:ASnt7M+GOL2lQqn1xlPJfAqW927dJDw
TLSH
T19CC533FDB0D4D1E6FE1162F11EC42337197698C7970563D40089631BFAA6A0ADCE9CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ustanovka.png

Path C:\Drivers\Horriblegraded4873\ustanovka.png
Size 14.7MB
SHA256 b22de43d8ccfe69633cc52316444d972c7be54a4ccc35eb3bf5f0dedf9446b8c
MD5 953a5a10006187486925c8ddbbaf0774
SHA1 3e82a0d90851e9d3b9d5d60ebcefd4199acaa9e4
SHA512 094defb50b3740337b4392109cc6149801e09e5643463c058df3c7d0c54c7d4150ebdb880df2f616515054ab87455ff6af5a9fea79e01a98dcc4e12ee3bff27d
SSDEEP 393216:OX+vtrERa+t6F1WOwnApsUhaZxtCDa1s4XVULtk:e0E4N0nzp+KiLi
TLSH
T108F63344D721293DDC4F41F5E4DF7A112EA0DFE8AE44A0787DE28F15F7100A69A8BB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StoningFarmers-4687.jeA

Path C:\Drivers\RecipesConfirmed\StoningFarmers-4687.jeA
Size 4.3MB
SHA256 ba582eb06a15b11e814f0b42606e9abec384752c55d11bdc6f18d202e055dc06
MD5 5bd1f33f734d53baf8d365453027d2fc
SHA1 0ab3fac8d01ca3f665a49fe965ab972aec110eef
SHA512 a701cdc7712e31f0c2cf50336b73d891a09fa86a198723b95e7338a049ad86561b8449af8145eee34bf2c68ada526e3dc448384f9dfe8311fcbaa1c30672c03c
SSDEEP 49152:XiALUDnB+ZqDTkTj5fjmTnnO1sNnNDyIIwf5YxAO1DLcnqstK:yAutT456nksN76SO13cnp
TLSH
T10126CF313111AA18E16F431AD0B85E1CC6BC694997BB8E9C9F23FAF27D56701EF78048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swearflesh6239.exe

Path C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
Size 340KB
SHA256 928d415556becba897229b293cf9c9bc54b78721e5911728a0633b22f24d1f27
MD5 06e26df88466cd28d243201b2cbe0640
SHA1 4d78b2d38fac1115d10f7b275e2e9d09eff56caa
SHA512 80a31f2c98f91edc74ac4a57f6aeead8d10466eecd4eff03821ad6953fbf2394726295f412359caecea8e3f4994ba3505ee0fcb93f2d377d96204cacf8402636
SSDEEP 6144:lE8+pg36hoAorx30faYOOlVT8NxU8NA23tfcYMRPTlmk:ltGN6rGTRYNFdP+pT
TLSH
T168746C11BB9558FCE957C0788241CA73AA377C860B21A9FF11A452393F27AE56F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inclusion-Hypnosis-4521.tr

Path C:\Drivers\anymoresubsidize12\Inclusion-Hypnosis-4521.tr
Size 10.3MB
SHA256 bf55b0323aa437985ad974075017d10a90ae37cadb8a4d0f1ff14e0220e74917
MD5 5c28ad6b50a759039700fe649f964639
SHA1 593de913a5e5a691da8deba9dfea1f1c15d37a44
SHA512 3a3ca05d5e4ec62bea666dd0c55d2f8b00a551e3640efcb8a2a88fdcb7520430888813a3d29b1501b322423721916bf09752d38de05581776164bdcc95efd2cb
SSDEEP 196608:woqvXG5QMJDBWzH6C9G2JBynuIvA2ch4dSMBLu88GWNM+Y9t9JwRzmabC2:KXG5uzaM47hdbN9J8mU
TLSH
T1B4B633BA961AA0C4F5EA4E454F0B1B3E7268DBFD969D0897C0E8234AF11D3E0D3D151B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 5KB
SHA256 50a7ad17584f5660533872eda965c95c9cfe5d45b33ed12f390e3b8633b2eb7c
MD5 cdcbfafb40cd2ca71dd96f2fe0edaaaf
SHA1 e3202a23171606bbc5ae21f86bb7296e522de329
SHA512 8b4f9a47c1daa841e7839f333cd463556f8517be8e4d721db2cdce7607aa98805e2c7651f203f3ce52e523072aa134542d8a6737a8b4878b55e79f6b012e2e78
SSDEEP 96:QpvAybUhoMKbmzQUaICbleNmcQ2kjyCKrvG82biMbO2sglhI12glcRjJ5GXo78IN:QpvzbU6dhNbkY7iTG8SFbO2FlYdcRaYz
TLSH
T1D5C18E63436BF1CDE93292300549B0936462C6ADEE7460B1B22574763D355DCB4B84AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 104KB
SHA256 55961a5c056c3e8de0a9a15b47f9b4cd82ae4a3a4119f7a5d4462820a95479d5
MD5 5ca5b56a71f36559afafcf26f866758b
SHA1 8e4502d82d32a3ff080b49994ea36edbff259c65
SHA512 2c71be0ac166d0893794b5b575e207f5aaee83312c87b3ea97451f47cea86a5888f5da2b8fa80846cecc5f71d3e94c1900a277a69cba9e035a9d11a9f0db6355
SSDEEP 3072:6iHREVARUTsN8leZ8ePR/JjkPSLsbB6NTvoRYTmGAH5UlrQfCCV:XxEVAcsIePR/eSLZcRYThPOtV
TLSH
T130A3028BA353F1CE2163EAE0E498F2C0FCD546D7B6408CBAE93615492D2099FF3C5555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 133KB
SHA256 9ce36916c0587a99eca2aa8815b46412d0a33365007a4f14520de8f2c6a0035e
MD5 aee28b5ea93ba88888d7fd897ee42e34
SHA1 d97979e680b5a46319b40809bbc8d6dc520b7f37
SHA512 8791afb989c829b770105634db215115d97cf7a4aba0c484c199a04e679b49dbe25bce158da80f7590fdf5bee1ced4953d3400f799e554d73469377d99287a7b
SSDEEP 3072:6iHREVARUTsN8leZ8ePR/JjkPSLsbB6NTvoRYTmGAH5UlrQfCCnkPW0kA5/G:XxEVAcsIePR/eSLZcRYThPOtkoAo
TLSH
T168D3128BB292F2CEA1A3F9E4E5C4F1C0FCC586D2B6408DB8DC3651862D2059AF3D6955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 15KB
SHA256 8e5301f0b97cffd266dedb5970cd30f685f205ba12e0d206e32d1f4150316020
MD5 bb3e5ecbd952d3f8083412f41484512d
SHA1 5c1ad102f792f86fd5511a1d8e0a24b534d30f7a
SHA512 b87b08547419e2f69819be1f7142066b8dff2082f0d864a90f8da78c74c1e138e5264af1ba71958fab5ed9a1a16b025101df87264a181f27b80fbda83cac990e
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIIsGo:Ok6dFBAJOWR8NJDR2x3Go
TLSH
T1BD72CF1B5363F1C8251BD3220E82F060FCCA41EA765458B2F9365A612D56BCD63BD4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 e8377c74efb04b6a064ee9960a8a37436850edee592388d697b5a469374d4f69
MD5 85c162d8d63d20e77d53f5ce85745731
SHA1 cf4d3d8b2e4ed2775ef70e7bd591d79d768196bc
SHA512 bb56b2102999ccfeea86d99110b35c3e25177373872b83d7d08c46981bdf39bae361c8a8b6b07b135ed5e0627efcc54ec08026e2bf1d357bfa5df4cb5ec0280a
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIIsGxxl/I:Ok6dFBAJOWR8NJDR2x3Gxxl/I
TLSH
T16182D11B5373F1C8751FA6210E83F471F8DD81EAB60404B2F53645612D269DDA3EE4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 33KB
SHA256 0fc120d9db98b2f7bf2fed9290be6b9fd4a1e1ec0c2103669380b026b7ab578a
MD5 0a0b7897c78b4da1851c4567a329f5f7
SHA1 7eaabce20ab9f58c230c9d9ada6f548562038226
SHA512 9a4527ace6f5108e17eefd0c97df04e5199018bf200ce7696ade68d98a03a037e70bdda1b0974454b9721836f4168ed74db1c16ecf7d7d4fb491253c783f3ce7
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vg:Ok6djGOWRE923OjA5EZCpMDVTsA4o
TLSH
T160F2E15B9362F0C8746FDE746A45F0E0FCCA08E4BA004976FA112E562D6298EE3DD458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 34KB
SHA256 8ad4eaf21bbaa857917bc5225f23814fcb37d3e6bc17ec20fab3ebf9bb644ead
MD5 5942eafa4aafc5e17055fef084d4a320
SHA1 501f87a5965b02f0af3d81171ae6290dcfb5ce04
SHA512 c38029596211af06746e750851efeb0506c7cf1773494b5f64710dcdf66fc20a38e4684ff922fa1b7154ca538f05971258e0b3de2d0132f62d3e73ea23d303a5
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4v8:Ok6djGOWRE923OjA5EZCpMDVTsA4k
TLSH
T148F2E15B9372F0C8746FDE746A45F0D0FCCA08E8BA004976FA112E562D6298EF3DD458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 3fa47e31b617882d6d2f229f790219e639a91f29a744c9db79fc693bcab581b9
MD5 8ac951ad6ff89cc69afb5ad9bb4303d4
SHA1 e88db85e3dcf73c9c0539b3d19c9a0107dcd9c75
SHA512 429a108836eedd7de6c39e14183abc058c942ed7e1e4137e0fe6b5faa848444343c03a61e4610b07bd51132b612f2d3b3e2c5c66b2d07a2ddf37f51fb1f64918
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlZ:Ok6djGOWRE923OjA5EZCpMDVTsA4NZ
TLSH
T14CF2E19B9363F0C8746FDA646A55F4E0FCC908E4BE004876FA211E962E6258EF3DD548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 1000c7d820ef776d533d41954acef9df9c6251cdf93c27f81971f85ed0c4514b
MD5 7ba05ca67b29ccc26da0019ecd811950
SHA1 559dc2f3a330588218fbd3b9d2c41feb6b2f425d
SHA512 a7509248bf14a4c2fc9076f8bfc56691981fe126f8ef326ee368d226e432a35aa6f98d8c914abdaf540825356a3e8bc4e278fbb9ba0b532d0da69f024b2b4718
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlEnj:Ok6djGOWRE923OjA5EZCpMDVTsA4Nij
TLSH
T153F2E1579362F0C8746FD9746E55F4D0FCCA08E5BA004976FA111EA62E2258EF3CE049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 36KB
SHA256 f496f1606f56ae0e71d0b355b021e432548b4847bee2544a19f336e27032d7b7
MD5 0c58aad921264ee4149d9bad822498e6
SHA1 55dc4508816ac120b459bf09fe47d1d4d6b5f236
SHA512 c256e44a174753d1d4c1d4d1cb9c364119a227401a04e324f8030bdbad1add552c37073872a884d3b915f3d25814caa214efc09487479c3a5fba7578b9225be2
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlEnK:Ok6djGOWRE923OjA5EZCpMDVTsA4NiK
TLSH
T158F2F1579362F1C8746FDD745E55F0D0FCDA08E9BA0049B6FA111EA62E2558EF3CE048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 efae1a3f9d80a7e1b04997f3e5f0f0a4e7b0a0bca8197fb15342bad76ec7a764
MD5 7a0b64f1feac116c87efd22b98daa407
SHA1 056bd7da994150e31c8065fa236426e8e8db8ca7
SHA512 3fe7b4906dcc66d4f23912f0a587c29fd3558fd15badadcfeaf248647e5384a2ec4b9b20ac65fa0a61b3d958609fdd1e5f1cef683feac4a0e311ff4671901b52
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlEnlfewqXi:Ok6djGOWRE923OjA5EZCpMDVTsA4Nil1
TLSH
T15B13F28B9363F1C8745FDDA05A95F0D0FCCA08E57A005872EA116EAB2E11ACEF7DD494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 42KB
SHA256 8896b461f91484f1f7684c7fcdc1a89f89a15a8a6920adc99a40f9d217614d50
MD5 634ecbe2b13c9e464569df064550b7fe
SHA1 e1b580750410e39248b9caa49dd90560b11f9646
SHA512 2a45ca151b4280b225a7de4ff5e85a8d594095d42410de93f353c8a0aeec1957539a41193c17952eaa15bdd8342e83db922446e58c73312811ede920c7b5ea9d
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlEnlfewqXkc4z:Ok6djGOWRE923OjA5EZCpMDVTsA4NilB
TLSH
T1C813F28BA362F1C4605FDDB06685F0D0FCCA09F57A005872EA116E9B2E21ACEF7DD494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 9ae0373afd7d51adbe5e4e647e89c1351a5d85f8215f35988c226a051bc01150
MD5 b702496668a2f3b69c91bb28cdab52a1
SHA1 2092257531b65ff4bb69c1972cea4849db5304ab
SHA512 8c2c45760c275bd245361ce95f34194e7bb2105acde04baeddd6a6d8be690c2fbf2c2f8f28e146a1fd642fbb687c8978868e45dd31322e02d4dcd6ee8b259bed
SSDEEP 768:Ok6dFBAJOWR8NJDR2x3Gxxl/It0eo+MjZCZESMD5jTpPRY3Oj4vlEnlfewqXkc4R:Ok6djGOWRE923OjA5EZCpMDVTsA4Nilf
TLSH
T17713F28B9362F1C4615FDEA06985F0D0FCCA09E5790058B2EA126E9B2E116CFF7DD454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 52KB
SHA256 73be790868749ac8aa52c198d655b343c784295c2ad9304d4d7523c01d098a66
MD5 9bd2744bf15e6a071c7eea8b68b87448
SHA1 f950c8abf20717cf4e542be7ad518fa6e7939c39
SHA512 4a5f65b41256b23c4919aa601da2490d2cf2ee372972011229de31d0ecb48492f11daddc517d656c6fb6fd2a5274e8b9e520fbe55e78837b4c56ca8050103fc1
SSDEEP 1536:Ok6djGOWRE923OjA5EZCpMDVTsA4NilePh4Jw1O+CEPH7ts:6iHREVARUTsN8leZ8ePR/Js
TLSH
T16433F19B6393F0C8325BD990AAD5F4D1FCD509E27A00A872E61326DB69209CFF7CE051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 1KB
SHA256 fa399166ebe8b20ee8363cdc682a17bc76757c159d11bedcbdc9b30a9cd889ae
MD5 32fb58b0c00b1da1872e9e2d88d335f8
SHA1 b0c8b7410ac9102ce5a025471435f85fb2af29ca
SHA512 64d18c414dcb24d4ea7ffd1cccc452dc38eb9c5ea9470f30956a6084078aebf93372ab1d0b050ff35313084fa34a095037cbef54de65566906479adb926577b5
TLSH
T1933118203253F5C6822B323261053847C982463B5C5D62D7612570B8B1E94E82D3893F
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 95e3cac6666d1eadc1764ecaf91580936c1fcae66417189f6594fcc860dd5cbc
MD5 52e5c35527bf0d9628b53211882b1122
SHA1 0c3fc2e2981ec0948b3ade2e8476bd4b4e315471
SHA512 3040fcb2fd623b086fbf3e2e081af6b10f274e67b42e2f4e4c792f0f04db5d4f5669f18566fcc240e6c9854a57070d315d6befbd9afe860f49f836e5b5108292
TLSH
T1A4414C327362F0CAC72B33321509B4978DA247632C9D22EB2228303474994F91CBD46F
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 76KB
SHA256 1dde478afdfb19577e36ab1c8cd36920d19c10095f61248efec6118c1039542a
MD5 ad419e8c3c8d2b1c2731a57edd26fc36
SHA1 eb41b5e1dc9c9a36a07d221dc8baa418489b1ea1
SHA512 7bba9a41fcc9f215f7e4cab31806b4da7d19910afea0ba7cab3313e11f63549d6e12bce408bcda087b942b4fdca24fe37cbb3f4ed774b19d0f24c6c5d6545d98
SSDEEP 1536:Ok6djGOWRE923OjA5EZCpMDVTsA4NilePh4Jw1O+CEPH7tWwkPSLsbgkmtNTvBUQ:6iHREVARUTsN8leZ8ePR/JjkPSLsbB6l
TLSH
T14873F1D77353F1CD2297DAE0E8C4F5D1FCD50AD2B700A876AA2725892D2198EF3C9056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 224bad782dad17e82bd1e74652d913b16eb62065e73d9b1cb12b137fb88ef17e
MD5 bb2c9754a2440b7f3482578661ea5b08
SHA1 8a055d8fecd4a7b21a9c6eb9b32ee342abec1f8a
SHA512 9c6d13f46ef253adbed088d6a76868f3b1561c760022891b882c96d6a8af1b1694649e0d5333d1b7fba8477564d414b3dd6a791c97b5b54071ab2d89f3f3b098
TLSH
T1A4615D222395B5CF8633B33501497592BD53C65A4A7865E2310178A578664EC7CF817F
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 5KB
SHA256 8ac9dd21bdabf1eb0f6a6802bd4af6a8f9a0a7c3697a23056e5fdfc3cf7d5f9c
MD5 8318a1c4b0bb48cd7a8102fc4cd21177
SHA1 2324d458ba1a7c9352d0f68af787aa4036881b83
SHA512 6c209de19fc4651a2c20f97cc2f1061e842209124c5181fbe5ab8acd81d0f170800b7129ed7fe2bce1866ad7ce94e6e7c12c2682ab8565b06d5d06ead4247fbb
SSDEEP 96:QpvAybUhoMKbmzQUaICbleNmcQ2kjyCKrvG82biMbO2sglhI12glcRjJ5GXo784:QpvzbU6dhNbkY7iTG8SFbO2FlYdcRaYH
TLSH
T166B18D634367F2CD9622A2300559B4D36463C69DEE7460B1B22574763D394DCB5BC06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 104KB
SHA256 9941387ae28497a5d1d8824c4a95a534fec4e22746408246f09b1d272db2561e
MD5 0b158fba6a04134a43d14b828da4633b
SHA1 ef3fbc5960a9b3ee6e61fb860a3f90ea0afea9b6
SHA512 065860a7c9735c7cb461491c6d6e538beff85e13fd830ef115a3ae1b268025ef82cf36a6b62cf0e6ad648414164b19e6865c280b9a62b4de46b9e0671ab86ea3
SSDEEP 3072:6iHRElcRUTsENleZ8ePR/JjkPSLsbB6NTvoRYTmGAH5UlrQfCCy:XxElccscePR/eSLZcRYThPOty
TLSH
T1D2A3028B6353F1CE2163EAE0E898F2C0FCD546D6B6408CBAE83615492C20A9FF3C9555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 132KB
SHA256 fdbd72c7668ca7849ca0b7864b0ca4e0c375906f91443579cae0b94f2f1fe3cc
MD5 0fee01ab334899c7b334c3000099a60b
SHA1 1024b7a9e9c6ffda5e4c9094465c115bf36fa482
SHA512 d3450348a529e9b9055fb84e0d6966e0022bfe005db63dff50684a8b3a85f8867ecd2befe9648ea1c9fdd2f74d27d7a8a3c5619ebe5f83176d872693849886cf
SSDEEP 3072:6iHRElcRUTsENleZ8ePR/JjkPSLsbB6NTvoRYTmGAH5UlrQfCCnkPW0kA5/t:XxElccscePR/eSLZcRYThPOtkoAz
TLSH
T184D3024BB292F2CDA1A3F9E4E5C8F1C0FCC686D2B6408DB8DC3651862D2059AF3D6955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 15KB
SHA256 ab569a765808898927e8b164b3f4a365970006e2754ddf12f00e811dd25a2305
MD5 02ae080b2cd96bb1df1e7ac9714688fa
SHA1 38d199349639c0d9fdf483665eeec01ae8c0ec1c
SHA512 0f88b31ca7217a5b471e68758cd3c1d6650ca4b2b262e39957087e372db7a83664fe73ed27ee6c109b9d3feff9a381d74d1a7feaf7e6f9eeae8f7b6b91882460
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIc0Go:Ok6dFBAJOWR8NJDR2xvGo
TLSH
T1AC72CF1B5363F1C8251BD3220E82F060FCCA41EA765458B2F9365A612D56BCD63BD4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 16KB
SHA256 43eade50e5b3c2f910f8c2ddf790830e69ca62ef918703bfa3c92a22a282dccc
MD5 2e2b63548e91828f384761e99162fa13
SHA1 fe554745f683ffbf9205daef070f8b33eb163bee
SHA512 2af92c19e959ad84e380ec8ac261477c228ab211e6b0b0cd16f00ef923748b239ec17f4529119001ca19a619b9517c5eb1189530f5616a257609f61af6a47051
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIc0Gxa:Ok6dFBAJOWR8NJDR2xvGxa
TLSH
T18472C01B1363F1C8251FD7310E42F060FCCA41EAB65458B2F53659B12D26ACDA3BD4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 16KB
SHA256 a5d6a37eaa45d2269cfc1d2a6b06895fe5aed39c6567d791b70a644c75d6d3c6
MD5 b0b37e2cc58c0f0e2b3a13381b156716
SHA1 b6f5c1a7a419cdda46bd520778e17617e24c1d8f
SHA512 9963fd86ad2d9f9a9df002f599e7bc9c35c0e1173354c25ff8526fada47200ac8a414b18a9811c04f6934718bc62dd4fa55d4deba2f5a1db7c648d177f91fcb8
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIc0GxdlK:Ok6dFBAJOWR8NJDR2xvGxdlK
TLSH
T1F272D11B5373F1C8251BD7210E82F470F8DA81FA760458B6F53645602D26ADCA3EE4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 17KB
SHA256 49df584a205d2ad9222b06a863758788bbc574eb3fa3c8273567452a9d95a6a6
MD5 153713761ed6369a834d854170c5490f
SHA1 6aec220ee44bcc12825da7471017d7eca85f5067
SHA512 92dc9511720dd8b2ec8b8c45647fe89ac43ffc5df3fef1e6428d896dc738822323568f6f5303d28316514db2e39bf98205d83f786c0432b960acf051aefca7ac
SSDEEP 384:OvPU6d3bF7dtFbr3YdkoRVhqLWR8rMT0JDSMPGa0DPg1NIc0GxdlzI:Ok6dFBAJOWR8NJDR2xvGxdlzI
TLSH
T15282D11B5373F1C8751FA6210E83F471F8DD81EAB60404B2F53645612D269DDA3EE4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 33KB
SHA256 921857c096c6b40a29d910eaaa735d4839808406071987c49aee361961a59cb2
MD5 7c82e0cb760ce4768864d5885e835081
SHA1 0d450c8791377b65fa3cf439411d192dc37cf17d
SHA512 264ee4a63a00db115f90fb30eb60981493832528e9d1d0c9e0eb7aa7dd5b19c1c8d44676dab831a833ff3d2d2d3086199b2d46cb75b0afe643be06677fc8bc9e
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/Yg:Ok6djGOWRE92vOPc5EZCpMDVTsA/t
TLSH
T152F2E15B9362F0C8746FDE746A45F0E0FCCA08E4BA004976FA112E562D6298EE3DD458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 074be2e426a43607755cdb8d5ad186d406a7b8e261b5905b5aa7f75d5a849a81
MD5 94f7cff1665da704240647f7240a2ecd
SHA1 6b7b41be722cc8d67d9a79818704e32a7dd17cec
SHA512 714b8690eee6a2be30c6a81145b56a3c973cb6436a95813b989d68d2deb25b3d2ed1e6c0a6b6a1583145a748a3db441f04a08ccada4dd2e7192a886ff0688e1d
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/Y8:Ok6djGOWRE92vOPc5EZCpMDVTsA/r
TLSH
T14DF2E15B9372F0C8746FDE746A45F0D0FCCA08E8BA004976FA112E562D6298EF3DD458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 d8cdb1bfe169f668dbdc8c3cb3e3585c4b23cc7f53e7ab4045c4765d088aee47
MD5 b4f4129649a38356deb64b99d28e91f1
SHA1 3b114a01f9bf5fcaea29f22872d0306667963ac5
SHA512 c185000d8acbbe92f492e669ae29f93514bb9f679940895b80cd9a3e18b831e52343bcb38e6143f479539588450a22a8a645095cc4ca4c7b48b2008750361e49
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YZ:Ok6djGOWRE92vOPc5EZCpMDVTsA/c
TLSH
T1BDF2E19B9372F0C8746FDA746A85F0D0FCC908E4BE004976FA111E962D2258EF3DE958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 35KB
SHA256 a071e56e8f266fc405e72f9c75fac269086f7b57627060b9a062619482a307b6
MD5 b0692ab713b1e05e8a29fdc3ab389de7
SHA1 f33b044317f3a5375cf2eb0a498271140045173b
SHA512 0879ef9058617b1d314f147345fb4c07b9792fa0ef449e41a03b1b6e11bfcd0bc399ea3567a0c6f40ada25f3869065daae7acb9637bfe7566347180ca8f03ef2
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YlEnj:Ok6djGOWRE92vOPc5EZCpMDVTsA/6ij
TLSH
T1F0F2E1579362F0C8746FD9746E55F4D0FCCA08E5BA004976FA111EA62E2258EF3CE049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 37KB
SHA256 5278aa04d3f10c11f4d9bf15946db76de27bbf70eba17eb249b88797ee93788b
MD5 079b2c4e1ef40c66d521e7839a213b35
SHA1 b9a96f5018fc409a1c62a55341992177a8b637a7
SHA512 9eb3c7f99d5715d370d3f3b653088ecdeb9d4ac8d539549b8f8d764f38d047632ae71d105ad79b2b2c18dab0e3a2e83beddbc5cb0f1426483c084dd0c5d1ce30
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YlEnB:Ok6djGOWRE92vOPc5EZCpMDVTsA/6iB
TLSH
T18303F1579363F0C8756FDDB45A55F0D0FCCA08E4BA005976FA111EA62E6158EF7CE048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 41KB
SHA256 8cc753ec29b427880b218402dd473d165678d2a8557fbda3ccc750adff5b43d4
MD5 8f975ec4ef03d4fa2eac22b12c0e1922
SHA1 6c53b27240df39898787fc513ba51b22286f1cc8
SHA512 4f81a76579c91caf49bd3caa8b8e6da66842efc355845812c711c3296f0ef90584656658cc67493b100c8d34ddf94dc00f8d199432e435bdf001607b9683edcd
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YlEnlfewqXi:Ok6djGOWRE92vOPc5EZCpMDVTsA/6il1
TLSH
T1F113F28B9363F1C8745FDDA05A95F0D0FCCA08E57A005872EA116EAB2E11ACEF7DD494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 42KB
SHA256 12dac7952ee6760139d94468e0948be497e244ab4b3795aace87b6c6ad7e7951
MD5 cbd5e4e9acfb7fd29a359eec98c37284
SHA1 cc3f88541ab32e696a4878b6fea19e36651ad2d5
SHA512 08b7fca5189425cea3ded3be3c4789aea9aadc94d98844a6c504c3d5e1042471e61ee2f75684d58b193dbe208b5c915e002ca9a1769db57bb9285ce174844e08
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YlEnlfewqXkc4z:Ok6djGOWRE92vOPc5EZCpMDVTsA/6ilB
TLSH
T11213F28BA362F1C4605FDDB06685F0D0FCCA09F57A005872EA116E9B2E21ACEF7DD494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 43KB
SHA256 eac826b7c5630f642bc1787feddc31f805db39339cd865671d878cd783773c3d
MD5 36335066f841ad625d064b42581fb407
SHA1 1ffd3d1eb2f837e65723518a0e3bfc18446d2218
SHA512 72202023e712c2daa68539fd838210f9f281d96371c59b3d6b0020e3351a5d58ebb034d11db446b1d191b4fc2760fa3a4f5614ad0b1c508002f4657939fecfc8
SSDEEP 768:Ok6dFBAJOWR8NJDR2xvGxdlzIt0eo+MjZCZESMD5jTpPRY3Oj/YlEnlfewqXkc4R:Ok6djGOWRE92vOPc5EZCpMDVTsA/6ilf
TLSH
T17213F28B9362F1C4615FDEA06985F0D0FCCA09E5790058B2EA126E9B2E116CFF7DD454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 52KB
SHA256 bdc387d96b6858832f44bf3a4e7e4e0a4c9691a0ff7a657c501a8d9f646801f4
MD5 d23ab4e09cd8a464d0cb7e3149a49994
SHA1 45a0e34fbe391271d887ed619b09befe836c8333
SHA512 687542b6be64674f052318a5c8ba6d2f5943f237472d5bafc8985627a71d7f539c4cb59b59ab5d66f2389d38b6ca2eb3fb2eadb264221c72c4c384cd4ea733ff
SSDEEP 1536:Ok6djGOWRE92vOPc5EZCpMDVTsA/6ilePh4Jw1O+CEPH7ts:6iHRElcRUTsENleZ8ePR/Js
TLSH
T12A33F19B6393F0C8325BD990AAD5F4D1FCD509E27A00A872E61326DB69209CFF7CE051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 76KB
SHA256 f7306644f252b24a70b838c218498590be1e04a7123889bc47808007e2c7d3b6
MD5 8c364780d44c4506353040a019f1a2d1
SHA1 0049b3eab490bd09762c2a7d5982d756479ce599
SHA512 c8e7e108e488ea5895d841fe89d822e836c1edf80ebcc5f6952342076d4953c701b69d1ac941817a30e6f800be34f826956894e019fe841cc18f0e3cde47dd14
SSDEEP 1536:Ok6djGOWRE92vOPc5EZCpMDVTsA/6ilePh4Jw1O+CEPH7tWwkPSLsbgkmtNTvBUQ:6iHRElcRUTsENleZ8ePR/JjkPSLsbB6l
TLSH
T1A573F1D77353F1CD2297DAE0E8C4F5D1FCD50AD2B700A876AA2725892D2198EF3C9056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToDesk_x64_5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-23II6.tmp\ToDesk_x64_5.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-352-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-401-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-396-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-334-0x000001B1D5830000-0x000001B1D6A38000-memory.dmp

Download

memory/684-391-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-418-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-417-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-389-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-462-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-390-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/684-475-0x000001B1D6A40000-0x000001B1D9CB1000-memory.dmp

Download

memory/1076-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1076-58-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1604-53-0x0000025DD3070000-0x0000025DD329B000-memory.dmp

Download

memory/2316-998-0x000001F896190000-0x000001F8963BB000-memory.dmp

Download

memory/2352-51-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/2352-6-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/2624-199-0x000001EE02340000-0x000001EE02428000-memory.dmp

Download

memory/2624-202-0x000001EE02430000-0x000001EE0251B000-memory.dmp

Download

memory/2624-255-0x000001EE02430000-0x000001EE0251B000-memory.dmp

Download

memory/2624-375-0x000001EE02430000-0x000001EE0251B000-memory.dmp

Download

memory/2624-222-0x000001EE02430000-0x000001EE0251B000-memory.dmp

Download

memory/2624-305-0x000001EE02430000-0x000001EE0251B000-memory.dmp

Download

memory/3900-1223-0x000001827FC30000-0x000001827FE5B000-memory.dmp

Download

memory/5188-772-0x000001FC9CDE0000-0x000001FC9D00B000-memory.dmp

Download

memory/6120-547-0x000002608E070000-0x000002608E29B000-memory.dmp

Download