lumma | hxxps://drive[.]google[.]com/file/d/1y--C8OwAfFUwlMPRG93yznAF5_5Oh6y-/view?pli=1

Analysis

max time kernel
98s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1y--C8OwAfFUwlMPRG93yznAF5_5Oh6y-/view?pli=1

Score

10^/10

lumma privateloader redline logsdiller cloud (tg: @logsdillabot)discovery evasion execution infostealer loader persistence spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

77.105.135.107:3445

Extracted

Family

lumma

https://stationacutwo.shop/api

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Modifies firewall policy service 3 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

setup.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" setup.exe
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1520-623-0x0000000000400000-0x0000000000450000-memory.dmp family_redline
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Spec.pif

description pid process target process

PID 4236 created 3456 4236 Spec.pif Explorer.EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivBLLbjMs5AVX9oNG1XjDrwN.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1000 powershell.exe
1692 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

resource	yara_rule
behavioral1/memory/1520-623-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

description	pid	process	target process
PID 4236 created 3456	4236	Spec.pif	Explorer.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ivBLLbjMs5AVX9oNG1XjDrwN.exe

pid	process
1000	powershell.exe
1692	powershell.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exeInstall.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ivBLLbjMs5AVX9oNG1XjDrwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ivBLLbjMs5AVX9oNG1XjDrwN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exesetup.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 3 IoCs

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	ivBLLbjMs5AVX9oNG1XjDrwN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url	cmd.exe

Executes dropped EXE 21 IoCs

Processes:

setup.exesetup.exe0xG5cI5IDKWNKChyvaRAQLyA.exeW76tm0BP79JabYBOvPiXHSj3.exe__nigowHJ7J5_PyWdoRvVNHP.exeBF6irFAZeCH0eOcJairdn7Jd.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeTOYlYOJQKqb4muXWog6jC3wu.exeJOd9VE9M9LZBxt5_BczgzvOo.exemOZigL0_G48uSFBJ6Dzcu05Z.exeivBLLbjMs5AVX9oNG1XjDrwN.exe__nigowHJ7J5_PyWdoRvVNHP.tmpInstall.exeInstall.exepionaudioplayer.exeInstall.exeInstall.exepionaudioplayer.exeClvZjkBPXcWA0rQRZzU2K8ym.exeSpec.pifeqtpkqwqodik.exe

pid	process
5608	setup.exe
5248	setup.exe
4332	0xG5cI5IDKWNKChyvaRAQLyA.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
1208	__nigowHJ7J5_PyWdoRvVNHP.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
5312	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
2028	TOYlYOJQKqb4muXWog6jC3wu.exe
3672	JOd9VE9M9LZBxt5_BczgzvOo.exe
1368	mOZigL0_G48uSFBJ6Dzcu05Z.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
404	Install.exe
760	Install.exe
2528	pionaudioplayer.exe
5892	Install.exe
5708	Install.exe
5872	pionaudioplayer.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
4236	Spec.pif
4028	eqtpkqwqodik.exe

Loads dropped DLL 1 IoCs

Processes:

__nigowHJ7J5_PyWdoRvVNHP.tmp

pid process

5520 __nigowHJ7J5_PyWdoRvVNHP.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe themida
behavioral1/memory/4852-498-0x0000000000100000-0x0000000000A8F000-memory.dmp themida
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp

resource	yara_rule
C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe	themida
behavioral1/memory/4852-498-0x0000000000100000-0x0000000000A8F000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivBLLbjMs5AVX9oNG1XjDrwN.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service
T1102

Processes:

flow ioc

9 drive.google.com
126 bitbucket.org
131 bitbucket.org
142 bitbucket.org
154 bitbucket.org
232 iplogger.org
233 iplogger.org
6 drive.google.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

113 api.myip.com
114 api.myip.com
115 ipinfo.io
116 ipinfo.io
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

1792 powercfg.exe
3472 powercfg.exe
544 powercfg.exe
5840 powercfg.exe
3932 powercfg.exe
3400 powercfg.exe
5720 powercfg.exe
1408 powercfg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ivBLLbjMs5AVX9oNG1XjDrwN.exe

flow	ioc
9	drive.google.com
126	bitbucket.org
131	bitbucket.org
142	bitbucket.org
154	bitbucket.org
232	iplogger.org
233	iplogger.org
6	drive.google.com

flow	ioc
113	api.myip.com
114	api.myip.com
115	ipinfo.io
116	ipinfo.io

pid	process
1792	powercfg.exe
3472	powercfg.exe
544	powercfg.exe
5840	powercfg.exe
3932	powercfg.exe
3400	powercfg.exe
5720	powercfg.exe
1408	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ivBLLbjMs5AVX9oNG1XjDrwN.exe

pid process

4852 ivBLLbjMs5AVX9oNG1XjDrwN.exe

pid	process
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

TOYlYOJQKqb4muXWog6jC3wu.exeW76tm0BP79JabYBOvPiXHSj3.exeClvZjkBPXcWA0rQRZzU2K8ym.exemOZigL0_G48uSFBJ6Dzcu05Z.exeeqtpkqwqodik.exe

description	pid	process	target process
PID 2028 set thread context of 1520	2028	TOYlYOJQKqb4muXWog6jC3wu.exe	RegAsm.exe
PID 4608 set thread context of 732	4608	W76tm0BP79JabYBOvPiXHSj3.exe	MSBuild.exe
PID 4356 set thread context of 5260	4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe	MSBuild.exe
PID 1368 set thread context of 880	1368	mOZigL0_G48uSFBJ6Dzcu05Z.exe	BitLockerToGo.exe
PID 4028 set thread context of 5176	4028	eqtpkqwqodik.exe	conhost.exe
PID 4028 set thread context of 4564	4028	eqtpkqwqodik.exe	svchost.exe

Drops file in Windows directory 2 IoCs

Processes:

schtasks.exeschtasks.exe

description ioc process

File created C:\Windows\Tasks\bsqNJSiTyoMLfdbIdy.job schtasks.exe
File created C:\Windows\Tasks\bmQWCxleEgxbTUrSZz.job schtasks.exe
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

5704 sc.exe
3424 sc.exe
5516 sc.exe
3884 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1072 2028 WerFault.exe TOYlYOJQKqb4muXWog6jC3wu.exe

description	ioc	process
File created	C:\Windows\Tasks\bsqNJSiTyoMLfdbIdy.job	schtasks.exe
File created	C:\Windows\Tasks\bmQWCxleEgxbTUrSZz.job	schtasks.exe

pid	process
5704	sc.exe
3424	sc.exe
5516	sc.exe
3884	sc.exe

pid	pid_target	process	target process
1072	2028	WerFault.exe	TOYlYOJQKqb4muXWog6jC3wu.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSBuild.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

464 timeout.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

524 tasklist.exe
3736 tasklist.exe

pid	process
464	timeout.exe

pid	process
524	tasklist.exe
3736	tasklist.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exeInstall.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings msedge.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

5912 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5716 schtasks.exe
4272 schtasks.exe
5560 schtasks.exe
5900 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	msedge.exe

pid	process
5912	NOTEPAD.EXE

pid	process
5716	schtasks.exe
4272	schtasks.exe
5560	schtasks.exe
5900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exesetup.exesetup.exeivBLLbjMs5AVX9oNG1XjDrwN.exeW76tm0BP79JabYBOvPiXHSj3.exeBF6irFAZeCH0eOcJairdn7Jd.exepowershell.exepowershell.exeRegAsm.exeClvZjkBPXcWA0rQRZzU2K8ym.exe

pid	process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
2896	msedge.exe
2896	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe
5192	msedge.exe
5192	msedge.exe
5608	setup.exe
5608	setup.exe
5248	setup.exe
5248	setup.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4608	W76tm0BP79JabYBOvPiXHSj3.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
4108	BF6irFAZeCH0eOcJairdn7Jd.exe
1692	powershell.exe
1692	powershell.exe
1000	powershell.exe
1000	powershell.exe
1000	powershell.exe
1692	powershell.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe
1520	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4152 msedge.exe
4152 msedge.exe
4152 msedge.exe
4152 msedge.exe
4152 msedge.exe
4152 msedge.exe
4152 msedge.exe
4152 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exe7zG.exeW76tm0BP79JabYBOvPiXHSj3.exeMSBuild.exepowershell.exepowershell.exeRegAsm.exeClvZjkBPXcWA0rQRZzU2K8ym.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeRestorePrivilege	5416	7zG.exe
Token: 35	5416	7zG.exe
Token: SeSecurityPrivilege	5416	7zG.exe
Token: SeSecurityPrivilege	5416	7zG.exe
Token: SeRestorePrivilege	5192	7zG.exe
Token: 35	5192	7zG.exe
Token: SeSecurityPrivilege	5192	7zG.exe
Token: SeSecurityPrivilege	5192	7zG.exe
Token: SeDebugPrivilege	4608	W76tm0BP79JabYBOvPiXHSj3.exe
Token: SeDebugPrivilege	732	MSBuild.exe
Token: SeBackupPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeSecurityPrivilege	732	MSBuild.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	1520	RegAsm.exe
Token: SeDebugPrivilege	4356	ClvZjkBPXcWA0rQRZzU2K8ym.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5928	WMIC.exe
Token: SeSecurityPrivilege	5928	WMIC.exe
Token: SeTakeOwnershipPrivilege	5928	WMIC.exe
Token: SeLoadDriverPrivilege	5928	WMIC.exe
Token: SeSystemProfilePrivilege	5928	WMIC.exe
Token: SeSystemtimePrivilege	5928	WMIC.exe
Token: SeProfSingleProcessPrivilege	5928	WMIC.exe
Token: SeIncBasePriorityPrivilege	5928	WMIC.exe
Token: SeCreatePagefilePrivilege	5928	WMIC.exe
Token: SeBackupPrivilege	5928	WMIC.exe
Token: SeRestorePrivilege	5928	WMIC.exe
Token: SeShutdownPrivilege	5928	WMIC.exe
Token: SeDebugPrivilege	5928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5928	WMIC.exe
Token: SeRemoteShutdownPrivilege	5928	WMIC.exe
Token: SeUndockPrivilege	5928	WMIC.exe
Token: SeManageVolumePrivilege	5928	WMIC.exe
Token: 33	5928	WMIC.exe
Token: 34	5928	WMIC.exe
Token: 35	5928	WMIC.exe
Token: 36	5928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5900	WMIC.exe
Token: SeSecurityPrivilege	5900	WMIC.exe
Token: SeTakeOwnershipPrivilege	5900	WMIC.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

msedge.exe7zG.exe7zG.exe__nigowHJ7J5_PyWdoRvVNHP.tmpSpec.pif

pid	process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
5416	7zG.exe
5192	7zG.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
4236	Spec.pif
4236	Spec.pif
4236	Spec.pif

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exeSpec.pif

pid	process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4236	Spec.pif
4236	Spec.pif
4236	Spec.pif

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

setup.exesetup.exe0xG5cI5IDKWNKChyvaRAQLyA.exe__nigowHJ7J5_PyWdoRvVNHP.exeTOYlYOJQKqb4muXWog6jC3wu.exeWrJ3hKxsDqhwmb5nEKp_fGDf.exeJOd9VE9M9LZBxt5_BczgzvOo.exeivBLLbjMs5AVX9oNG1XjDrwN.exe__nigowHJ7J5_PyWdoRvVNHP.tmpRegAsm.exeInstall.exeInstall.exepionaudioplayer.exeInstall.exeInstall.exepionaudioplayer.exeMSBuild.exeSpec.pifBitLockerToGo.exe

pid	process
5608	setup.exe
5248	setup.exe
4332	0xG5cI5IDKWNKChyvaRAQLyA.exe
1208	__nigowHJ7J5_PyWdoRvVNHP.exe
2028	TOYlYOJQKqb4muXWog6jC3wu.exe
5312	WrJ3hKxsDqhwmb5nEKp_fGDf.exe
3672	JOd9VE9M9LZBxt5_BczgzvOo.exe
4852	ivBLLbjMs5AVX9oNG1XjDrwN.exe
5520	__nigowHJ7J5_PyWdoRvVNHP.tmp
1520	RegAsm.exe
404	Install.exe
760	Install.exe
2528	pionaudioplayer.exe
5892	Install.exe
5708	Install.exe
5872	pionaudioplayer.exe
5260	MSBuild.exe
4236	Spec.pif
880	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4152 wrote to memory of 456	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 456	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4232	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 2896	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 2896	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe
PID 4152 wrote to memory of 4732	4152	msedge.exe	msedge.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1y--C8OwAfFUwlMPRG93yznAF5_5Oh6y-/view?pli=1
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe103746f8,0x7ffe10374708,0x7ffe10374718
3⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
3⤵
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
3⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
3⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
3⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
3⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
3⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
3⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
3⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
3⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
3⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
3⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17917698884440153957,12359869126206820573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
3⤵
PID:5728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dvt9td218archive6\" -ad -an -ai#7zMap10450:96:7zEvent9562
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5416

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\dvt9td218archive6\License_setup.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:5912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dvt9td218archive6\" -an -ai#7zMap13234:112:7zEvent22956
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5192

C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe
"C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe"
2⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5608

C:\Users\Admin\Documents\SimpleAdobe\0xG5cI5IDKWNKChyvaRAQLyA.exe
C:\Users\Admin\Documents\SimpleAdobe\0xG5cI5IDKWNKChyvaRAQLyA.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Users\Admin\AppData\Local\Temp\7zS5E67.tmp\Install.exe
.\Install.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404

C:\Users\Admin\AppData\Local\Temp\7zS6695.tmp\Install.exe
.\Install.exe /DIIdidGI "385137" /S
5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
6⤵
PID:2760

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
PID:4688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bsqNJSiTyoMLfdbIdy" /SC once /ST 07:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6695.tmp\Install.exe\" 2Z /TpwdidwaJ 385137 /S" /V1 /F
6⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:5896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:3848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:6132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Users\Admin\Documents\SimpleAdobe\TOYlYOJQKqb4muXWog6jC3wu.exe
C:\Users\Admin\Documents\SimpleAdobe\TOYlYOJQKqb4muXWog6jC3wu.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 280
4⤵
- Program crash
PID:1072

C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe
C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Users\Admin\AppData\Local\Temp\is-9FBJO.tmp\__nigowHJ7J5_PyWdoRvVNHP.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9FBJO.tmp\__nigowHJ7J5_PyWdoRvVNHP.tmp" /SL5="$E0028,5287326,54272,C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5520

C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
"C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -i
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528

C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
"C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -s
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5872

C:\Users\Admin\Documents\SimpleAdobe\mOZigL0_G48uSFBJ6Dzcu05Z.exe
C:\Users\Admin\Documents\SimpleAdobe\mOZigL0_G48uSFBJ6Dzcu05Z.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1368

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:880

C:\Users\Admin\Documents\SimpleAdobe\JOd9VE9M9LZBxt5_BczgzvOo.exe
C:\Users\Admin\Documents\SimpleAdobe\JOd9VE9M9LZBxt5_BczgzvOo.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3672

C:\Users\Admin\AppData\Local\Temp\7zS5F42.tmp\Install.exe
.\Install.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760

C:\Users\Admin\AppData\Local\Temp\7zS67DD.tmp\Install.exe
.\Install.exe /DdidDNrk "525403" /S
5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5708

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
6⤵
PID:5372

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:5896

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
PID:5748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 07:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS67DD.tmp\Install.exe\" xv /aJTdidw 525403 /S" /V1 /F
6⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Users\Admin\Documents\SimpleAdobe\BF6irFAZeCH0eOcJairdn7Jd.exe
C:\Users\Admin\Documents\SimpleAdobe\BF6irFAZeCH0eOcJairdn7Jd.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:5840

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:3932

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:3400

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:5720

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "CIFUBVHI"
4⤵
- Launches sc.exe
PID:5704

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
4⤵
- Launches sc.exe
PID:3424

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:5516

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "CIFUBVHI"
4⤵
- Launches sc.exe
PID:3884

C:\Users\Admin\Documents\SimpleAdobe\WrJ3hKxsDqhwmb5nEKp_fGDf.exe
C:\Users\Admin\Documents\SimpleAdobe\WrJ3hKxsDqhwmb5nEKp_fGDf.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k copy Urban Urban.cmd & Urban.cmd & exit
4⤵
PID:4648

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:524

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
5⤵
PID:3136

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:3736

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
5⤵
PID:3020

C:\Windows\SysWOW64\cmd.exe
cmd /c md 780229
5⤵
PID:3364

C:\Windows\SysWOW64\findstr.exe
findstr /V "STEADYSIMSCOLLABORATIVEHUMANITIES" Stylus
5⤵
PID:4348

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Conservative + Transmission + Employee + Conservation + Coastal + Atlanta 780229\p
5⤵
PID:4156

C:\Users\Admin\AppData\Local\Temp\780229\Spec.pif
780229\Spec.pif 780229\p
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4236

C:\Windows\SysWOW64\timeout.exe
timeout 5
5⤵
- Delays execution with timeout.exe
PID:464

C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4852

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
4⤵
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
4⤵
- Scheduled Task/Job: Scheduled Task
PID:5560

C:\Users\Admin\Documents\SimpleAdobe\ClvZjkBPXcWA0rQRZzU2K8ym.exe
C:\Users\Admin\Documents\SimpleAdobe\ClvZjkBPXcWA0rQRZzU2K8ym.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:2008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5260

C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe
"C:\Users\Admin\Downloads\dvt9td218archive6\setup.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5248

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & echo URL="C:\Users\Admin\AppData\Local\VitaConnect Innovations\VitaLink.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & exit
2⤵
- Drops startup file
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2028 -ip 2028
1⤵
PID:544

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4028

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:544

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:3472

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:1792

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:1408

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:5176

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
214d26d3677d31abd13b6361693bb9a2

SHA1
582d315be7422b201b8ccc0d68f8554c626b3de4

SHA256
426970e3e004513740997da81bdcd4ad27c5cd0aa7fecb5c69822ff5af24d5bd

SHA512
2db22d155a72416156fdaeabf0d9150fc066d44849824f77967880c0d7bc1db189562419a0717a5f2935cade90c0d646ade248ad255a8d4fa98a446562940f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
3f9cafd73432ce4127906f5b0f6ce663

SHA1
3c63f6f57dfe90df6926c89f1060f6614504996a

SHA256
b3bd5ad8f1b4b1a42b187eef3fe59039379d0c2ab129cebb0656d50eef0b8d30

SHA512
e70bce9be2f224483737156f36eef5c69cc9f54a5051578d7f56e841811d119ed33f375871ea98129cb7069742805645b57d50983af5157c7fef1b6efd1938fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
b9f89b02c621c892214d57232aad75e8

SHA1
73d25fbdcaaa3efcb70915fb46f7b0dc4b5521ef

SHA256
c177e0a0dc86f8660f79d6fa2a538ff0ce2a1a319e455d1cac3d5ce2958f8cf9

SHA512
7402b48f2673ebaad38afaf4d65552613c6cee0cfbf310bd1dd9bdaa53eb9ae589d909fc4267137610ede9e2551b15fa2768dfab7d9e0d0259c7131dbdc72272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
488428712bee96d324771455f5b3cae5

SHA1
cbcebb88f77e7f40e746ebddb54d6e5c02d69ceb

SHA256
28e72ac8955645582c9035e2ca38894890a23dd5cce0796914f9265c0e82e89f

SHA512
756470b2506b0d3f4698c23c2893466829b3b2e08c39f9485981229cb61ee6b0fe78f3ca133e56d0375211fd862c6d8af523fb0c550ef95a27fe8a2ecf4606c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7ecc6904044a69d869723eb909f4b493

SHA1
3b7f1656743baba8d1f2eb9dc4d5ef98e16ba9d3

SHA256
a18036184aaf142f32f4e415d7a82e3388d21d024d3b669f47d45362202ec4a9

SHA512
cb51b9be2b22320efd25039123da896a48e124ed06a10bbf53feb62077627bad9402223a45e04835b922b3d300f3c91360cc34f3c11a85db46994a34267736cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c5d0a3137c2679cfa61a19f67f59eab7

SHA1
a3343972a9ef5c79c3d65aa2aee314f94093af40

SHA256
1cdb65d3d32f877c1cc725d8ee4c86a148523103f6f345f1669763286aff2c6e

SHA512
f19109e6c57cf5d868c4f0ce0843fa60e119f4de6ce0abcbd8af653d303837f0690079ef4d3561e262cb03bb583ba64898745b4c9e33e858390a624b72075ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
79ed747beb43421526d24e396afaae8d

SHA1
7034444b9c9be2f5ed26dad0f2a34edc4110fca0

SHA256
9d523343d78165502e29a15d8389a4d5bbd97804ed82787b7044188ad3e0b815

SHA512
d0a152a9b86acc8e8d08355852704db567ef8fca88032af1e5f153e5d908f75d0155d8c2a77c2ca8b21ec6c94056e6bee1c1626250b46e542b99c4e317e90438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
fab874569653cc5f66680312541c8d41

SHA1
b1edb8103ad4dc241cd44e22df7d09d199f71ea7

SHA256
3d58e35c5471a5828c8a64443e62da36a1d37f780f53dddf6aa7e9afe2becc38

SHA512
452dccf34bbfb9d4142316eb4886612a55a9e60b1912df942963fc90e64fc717879b73b3103985c809f3f7bb4c93b934ec9a8ce2e29a687ea47b0285923e1344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
8550d1ab9461b145c532afd7ffb5ddf7

SHA1
08419f7a68bbd36960a5080a3deb04a0a26b2409

SHA256
12a70712c828aeb541f539d242e3521e8d99d6b66875648a91e45344b23f4d70

SHA512
1f86008d873202e4afcff4c5e70b69d95a180f29a07f81fe438284ea88cdc9e8ad10f4a1467079abd2d75dad8e14ff42ad2e60683f89356fe392e172f74a080a

Download Submit
C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
Filesize
4.0MB

MD5
9b31a96f4666542461ea395f5b43439c

SHA1
80654cd93c1652e65f95bd15bb7fcd0969b25d76

SHA256
b6e313e1a207e0b8991e0883eff6234ebebd82a5d192c97ea67d0a0d563e5e48

SHA512
6777ddd0faf3fb9d0f0247a9cedf2de735d360c7ccfc7d8268b6de6e336a2bbc81d425df2e0585d59a5a3fac902eae84d0fa0daed772b5ee8da7820b47c7ddeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5E67.tmp\Install.exe
Filesize
6.4MB

MD5
fd2bbdd5884e1e41751df4b6bb635759

SHA1
caf0945968cde645eaa68e128dd75b84703f4fc8

SHA256
bf3e60dee68991fe4cf6f22cc38403355b0e5e360b4a21410ed1e858a0b4751e

SHA512
fb75f045701a0d875491cdf216cb22d479d19de7818936e99a0f9d4350876f79caca32a1b1fc27133eaef980deb02d346580d352f8b36ba0bae3291e894b6a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5F42.tmp\Install.exe
Filesize
6.4MB

MD5
860ee5203b65345154963dd04617b104

SHA1
bba88c359af5502bafbc5212a904c97a0dbf6d66

SHA256
504a30c45dfa6104f8af4f662894df176c1ad5df953a9182d6a7c6810aaec256

SHA512
e2f9fbed5638e36e54684e0120969ffeefd5d8f4f1cb350af60cc983f7708bdcf50ae7c96166ff324c5ce6b06f80e10c05e0a35ded82e468bc2b5d5adc944f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6695.tmp\Install.exe
Filesize
6.7MB

MD5
71bf676ae80afa9f2577d2eae6a133ae

SHA1
0fedcfbd17c9a11a97ce5c6b984926b5a510f533

SHA256
9f803c1fd9944d0050032ecd983de008c13c0e939e66d13c1d138551d290be99

SHA512
f8150af3a932ead9e6968569978ddba194b6355d4ac65bfcd7e54302e2f7f4b944c27baf3763297f5edc2d8eddb89bafea2489a79e1a77c695cc65fd967cf545

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67DD.tmp\Install.exe
Filesize
6.7MB

MD5
84da5fc2f43e551848349f0d0d3faca4

SHA1
cf0078c71fb1ef9743451b6a20d9aa0306e697db

SHA256
1989cb898e0e397b9acc16c453c94cf3f1873573979d36873182b18b8da86938

SHA512
9a605654c70dc27ae52760b2ced4aa3eedda6e98919ef96d9615c754f07e12c1748f6f978ffc916cb693e7788b21dc101a2442e3251f9a598aa223d9ead238bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Assist
Filesize
43KB

MD5
3d5a4446b998817ac3a378b584c185db

SHA1
8d45506c4e96d1832f6196f520ebaf7c306bfa0d

SHA256
1e5e63511babdfb0c84c679197f7f8229f217c5e906ae5f74ad27b3b4712c872

SHA512
6f174d0d9efe9ddd3d2d33d43dd199e0ca97b14a0c0bc809627aa6f4066a740a0d26f73b7993183822eaa8f94388bd7197e6c2b9d73051b6947baeb6696b1ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Examples
Filesize
69KB

MD5
cb2749a3d65fff87fcb0b47adb23fa76

SHA1
b0b6a9d11c7ee02d0d8953d450e9696cc601b7dc

SHA256
9919ebf3a126ccefccb5236c053dd2a511ea21a58e478f7ea747055c8ef09c6c

SHA512
0ccb7889ee9c94d5d38a03321ba2b5f6316f996792e494e68be75bac72c23db5a486c6bd40a21270ddea2db727c54a7566fcab5645e0defce289931f8825d6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fundamental
Filesize
49KB

MD5
230ed0afa33749b3c72b2ffde41dd1e3

SHA1
9c09200619efecb0a6dfe689edc322a281d83aa8

SHA256
abc1fc7f2d61a140868d22644c4309275989ecc5ef491155dcaf9459b438dcc9

SHA512
31b32ac30e5055d53d708b91fdb39df071f346d4a4417dc508d26153a5dbac2b4906a0e891d205d7d9809ee24eb3fd733e0c5394bed9b9b4804f8fd4356c2979

Download Submit
C:\Users\Admin\AppData\Local\Temp\Knowledgestorm
Filesize
61KB

MD5
5882258da7a689077b2f1dcbaaf43bd8

SHA1
71869c35d792e014beebdbd7d618803da9873074

SHA256
b69a3f1178ca18c6a34dbadea494ba9eb5e3956c3d13a504355a84154ea87067

SHA512
d96d61cdd4dad758c55081a79720d06e92434a4cff0610577618727a2d9368312acb1c448736b2bd0d1e3c99bf72bb1e9a281bf7bfbe8a96851794b2b43287ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Like
Filesize
24KB

MD5
409794898e575cf088a4b1d21233a91f

SHA1
67f47df2bba5a90b5ecc57c9641fed44c48cff35

SHA256
dce624d7c6c7525c6029bd118d98da93d6e94795a23ff3bddb619e5876e5b23c

SHA512
e4d87a890aa899c338d8f272cdac9f8c5c22f79007cb8b78a1ee989dfcbf7aaf84fdb88e6afd48d198cbdae6fea3540d8021b92dea58913698da80314ca5e738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stylus
Filesize
208B

MD5
ce77907dd56d674bcd0bbcfb7011bd93

SHA1
c8483cacfe2f8e81f8ef1a5068b6a42142c1cf4f

SHA256
748d79ad490a68ce10d337bdb791dadef6fec2e34b69b1eea4b976a95d53a0a1

SHA512
3c97ad521e092b429f210a4c98cd3de01c063fabc1f0d1d91a2389f4e223b4469be2b4db5d7a2a8c610331864bf684f1d8f1d1b654bf1b656508d91f12c7cf5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urban
Filesize
19KB

MD5
0acf541cbe9a635dab7b5bcf6f2bb645

SHA1
765e9babeddb81d9c0b88282e6b8a9ada0445de4

SHA256
873200c6afe55ab1b0c4bdea11370b84bca64d0bf7a5d2976416c43cda53bdfd

SHA512
71d1c51aa76b0e3adac409bc8124b57c529e12918b58dc42e4ffea603771377d654c88f7733ca04dd2b7daab45bd4b4a00aa5ca68604151c6077b6c803e3fe21

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxfmdeye.oat.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-29C24.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9FBJO.tmp\__nigowHJ7J5_PyWdoRvVNHP.tmp
Filesize
680KB

MD5
1c47be7867d5fb90ccf37808d1474f67

SHA1
0b24f8cba4f8f9e85df1dc144e37c5a36d8ef144

SHA256
d192cd666c467b89c52c7de07238e3e1ce7f494b015f7c9c0c3f859ed78a93d9

SHA512
574d89abf82c0f8ea5a40e59556c732890d71e8d4e7c677d151da0494dcdd8a95b14eb79dccbb4e92fd9295c233a12b9baf2ff7373639aa53290a2f57c24c1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8D79.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8DCA.tmp
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\0xG5cI5IDKWNKChyvaRAQLyA.exe
Filesize
7.2MB

MD5
23f544d203bf33aa116399e3bbf0e93b

SHA1
12bd225b90915d8f1632b9e8f62c60e9e9656c32

SHA256
4d0f1fba10d568cff1bfa75a6aab8a112789aa4c3e46cb11e510ec2912203ff3

SHA512
dc29135e6c9378deffd6c890ddaa5d6cb77406a5975abd5786583c1a745537f1cd213d0b2461cb32d0b5e0c58e5e9534bb36fbed6e0a99994d82ae0d91fa92c0

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\7QmYu1oI6IsaP_Po7RL7yHQi.exe
Filesize
493KB

MD5
7e4720ea4acb2692c05ddc387f716b40

SHA1
c452d95fbd37992ad84db6a07752c3b217ef6b3c

SHA256
aa79b2b1a29d67fcf50eaeb45050f782855f53f4486c48c6370824078f42c835

SHA512
c37ac1ebfab2c03087db6e3a8ce36dd1a30d8313e681894e7b8644e4f5d8ab6df31b33da6df14c0b2a38ab0742bd575e27a2e552c2fb87b5674a069b2bc52872

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\BF6irFAZeCH0eOcJairdn7Jd.exe
Filesize
10.1MB

MD5
3b24971c5fef776db7df10a769f0857a

SHA1
ab314ddf208ef3e8d06f2f5e96f0f481075de0f4

SHA256
0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5

SHA512
f70dccd6fd95516eac21b0cc30c70fb5f17c3c8f1f3b28fe3bdaec6053c2de53daf68caf422dea8861e4ab84f3dd7be36965c6998c1380dbf2a05a2a74b36b28

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ClvZjkBPXcWA0rQRZzU2K8ym.exe
Filesize
4.7MB

MD5
06333e350e25e29677256d9be86e4ee1

SHA1
088fa1f912473c3dfb5ab118b0bc39ec016cf15a

SHA256
137a7220fb3cbe605b6c74712ad96dcb1bdea1c489e9df159044500ccc23f3c8

SHA512
1475fd313ef0ca847eb7921b5bfb017f9b7f9274497df42fe3fa1477f40c6da8723ee0c46fa5c3fac6e9572c47712e1f4412c9460385c8f47117c82befdc329d

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\JOd9VE9M9LZBxt5_BczgzvOo.exe
Filesize
7.2MB

MD5
3b3b282f2508ea7f38b858955944f500

SHA1
8b900c53cbd8f15f31dd1c237cf95009f3fadec9

SHA256
afcdcc5f558d7f4556e803f9ee1463091512fac1b0e82889faebbc90c46241de

SHA512
c0fb59565fbe22d4b2b7c258c4ce1efa4df45277bc3487a9ec87c6a2932e85fec6a5ed5b9e81f6aed2bafcb893b191b14b6ff13b099d4c18aa8f5c0d1478bbfd

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\TOYlYOJQKqb4muXWog6jC3wu.exe
Filesize
935KB

MD5
5d505724b7a084217d7db6b2710d8613

SHA1
f444284be57973aa0d2fa22cdea4e3a639bdb6c4

SHA256
c4024302b2f74461f6aecd5ca2f2889fa8ed48a420cb2176ae782368e2c5c6eb

SHA512
bcc79a8856aa5aee6349d602d75c2c1c615a12502d1256b044572b69bb3ac3bb9632a4b61956d41c7186a3d97dcf376968983bd16b417a8dcd89ecc4aeef42d0

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
Filesize
2.6MB

MD5
8843145ba02f78a0f432586ded809af1

SHA1
42daf41136d6952ba8496b589a82ee88bb235e50

SHA256
b8d58c5f2346036b9db065278b62c2d8019d9fef5d5d6ed2b63621082f05eab4

SHA512
97eb7b621219ca6ed49e0222547bd30201524813c1b8b37df8cee285150a52f8fa0e49ead11e5b84521e01337f75d168e0f944b145ec8f213ef24d8ed074e27f

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\W76tm0BP79JabYBOvPiXHSj3.exe
Filesize
2.6MB

MD5
520f92170a2cf78ed3152f83973b9b66

SHA1
c6f979d3f405d1e9527566a9cc763dc2560ee39c

SHA256
63f33fc0da67b18a2a5d75d5509d7aee76f5b2bdc94ab5aead8ac09a91b0da01

SHA512
66d4c23cc9d276b947bce13c6089ca9676e30e1db07013b2144d2534728e8ace07ab3456cb66824416ba1f314f998be62a3479dda3143dd21d7778ce303846a7

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\WrJ3hKxsDqhwmb5nEKp_fGDf.exe
Filesize
1.1MB

MD5
470aed70b81cb24f9316bac75ce9c409

SHA1
6797699947374efbe4e4746f7500a1e2d92ce36a

SHA256
afbfed421c1da695c193849d153e11975eb3f2f6fa9d936bf987d4f046d86f7e

SHA512
b26ad5e4fac0bbca810554f0a5453bffa8ad4d654bd057fefc8e83e3dbfd42e1e63ddef308c445a783d8684038e9a2f1f546ff1a7948b93c63b886632e242cb6

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\__nigowHJ7J5_PyWdoRvVNHP.exe
Filesize
5.3MB

MD5
c51a0b6c89c4df20879e4edb9cfe70a0

SHA1
c7b190b8927696ede122b79ba5d40c1a6b7d4c86

SHA256
96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97

SHA512
cf39ba14c049fc995869caa8ed1a1c9dc3e43df95575fe6674a488e6b6e99229d1a9e41f3f19535ec33079ccf9b8f20068249b002d220853e7f946e218ab4485

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
Filesize
3.7MB

MD5
d2c328c49852296794a400c921c82e32

SHA1
0e86ed2329a4a638b6d172d5e54f3187615a0664

SHA256
e3c5121806297e551d348d3869f99a82078c508a463e66e529232d94ef6b0daa

SHA512
c0214ffd71c5b16d3efd16c3ea408ede805529f4306253122c27d54ae97719f0ec39fa789f7c7099700e3f388641fbbc1372a2b6df47ecde21e3c549cb099cf9

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ivBLLbjMs5AVX9oNG1XjDrwN.exe
Filesize
3.7MB

MD5
2ab891d9c6b24c5462e32a0bab3d1fec

SHA1
4dbb387d2fce2b47ff3699468590466505ba7554

SHA256
6ffd157eb781504eadd72996c2cdbd4881034ffb7f7d2bc4b96d4daa61fb4d86

SHA512
0317a30e9e70d0ac8416f14a91119504fc40e9a72ee34d358741ebf820367abb3b18e2c64987f6d86d3c4a8952621aebeca83fa027d66edb456c749e56d42d89

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\mOZigL0_G48uSFBJ6Dzcu05Z.exe
Filesize
4.9MB

MD5
2502f2fb88c1ea569c0b4287ae0613f3

SHA1
aae526d8ce17f59366b57d5d00ab5d14140cd6b5

SHA256
6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513

SHA512
7c0e3a6f8322aafa90533bcd2ff5ab2b167ef7c1c8412710c4b3a3b4643cdb0412cf93c561ce1c01a1057643bda336fd3fa64e3a7373d41cc25319d5190ca2d2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 743577.crdownload
Filesize
19.1MB

MD5
059b1751193f706f1d5d00a28b41e49f

SHA1
c2bc3b2e120fb046f99a23a63b7166134207067e

SHA256
c8db5c9576c1c42191f61aa9d4101eb1d64c805dd8c1c0b3e2384d4b7bbb3369

SHA512
1e3d920afbaa9dc6462a961e6eaa61fc0fd32ef66eb7a44114821034fd65b972b87ba00b739c0f6c3056fea16604a5203ad26dd230593216c6e1c84a99105e3b

Download Submit
C:\Users\Admin\Downloads\dvt9td218archive6\License_setup.txt
Filesize
393KB

MD5
0507b454d8793e3c59ed750dfeead0f4

SHA1
63c95b5ecb00d0e2fc956bfcbbd11b02800f49f2

SHA256
a6123d8923a3b9d825b9585425e4302496b159ce13dd1f4730d249e06024da26

SHA512
d97c2c056de3e23bf5850371032a2cc57d04ba29075609e54ed4753c22749ef5f2bca4a496fba172d4db456c9e00a544bb782e339e3294e80908f5a87844b2d2

Download Submit
C:\Users\Admin\Downloads\dvt9td218archive6\archive.rar
Filesize
19.1MB

MD5
37e5729cb57584abf79db0f66c1fc377

SHA1
e5ca481bc4b6f112c466c23c5b826f1d747c745d

SHA256
55575aa6b5f417c3a30b0e95bc194927e5be32647714b57abc02bdb332de0fa3

SHA512
427771b8b8ee9326a96356d9cdd83d0977543285966057aabb48f9f651f28c65cc83fb3136c538b9c1a435a7f5b9761adcd4f3623b4d69e1d97a3c71de3ca6eb

Download Submit
C:\Users\Admin\Downloads\dvt9td218archive6\update\Uninstall\unins000 — копия (12) — копия.dat
Filesize
2.7MB

MD5
a73d07ab51f706c4c75e1c8c41972b07

SHA1
5a488969ac4e537d93d42dcd39a022679959e94c

SHA256
22139226150a59706bc456190b0aa1b7afa3dce34f35013c19e5b5c4be31e8d2

SHA512
17382c22ea8a7269ad2d0cb94f9faa03c5dfcfb9bfca88d5434bc5e1163e4c6d5e48375870d6236f775a1f815527a197d7bf341588251ebfd2569145f1dc4375

Download Submit
C:\Users\Admin\Downloads\dvt9td218archive6\update\Uninstall\unins000 — копия (12) — копия.exe
Filesize
1.5MB

MD5
3ab31d714c50ae078f9eaba7b2497191

SHA1
45c5e807e459d95618c03a6ded9debe1d70013f3

SHA256
4f1ad8d1547c95e51defcb129c5dcf2568c9735524ab3face5f0fafc5bcbc0eb

SHA512
f89961fb914796b07da8f224317bb794f9cf0cc8b40e635823b0bb8a6713048c5b2de08e1c4e9dd4f81c6f579e3bc3551a9342ba34db9a6de1c0d6755ec140ae

Download Submit
\??\pipe\LOCAL\crashpad_4152_XBQANZLTZTFQVRRC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/732-1039-0x0000000009410000-0x0000000009486000-memory.dmp

Filesize
472KB

Download
memory/732-703-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/732-1040-0x0000000008990000-0x00000000089AE000-memory.dmp

Filesize
120KB

Download
memory/1000-936-0x0000000002B30000-0x0000000002B66000-memory.dmp

Filesize
216KB

Download
memory/1000-950-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/1208-484-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1520-624-0x00000000059A0000-0x0000000005F44000-memory.dmp

Filesize
5.6MB

Download
memory/1520-651-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/1520-677-0x00000000058B0000-0x00000000058EC000-memory.dmp

Filesize
240KB

Download
memory/1520-893-0x0000000006F60000-0x0000000006FB0000-memory.dmp

Filesize
320KB

Download
memory/1520-891-0x0000000006160000-0x00000000061C6000-memory.dmp

Filesize
408KB

Download
memory/1520-680-0x0000000005900000-0x000000000594C000-memory.dmp

Filesize
304KB

Download
memory/1520-625-0x00000000055B0000-0x0000000005642000-memory.dmp

Filesize
584KB

Download
memory/1520-668-0x0000000006570000-0x0000000006B88000-memory.dmp

Filesize
6.1MB

Download
memory/1520-669-0x0000000005F50000-0x000000000605A000-memory.dmp

Filesize
1.0MB

Download
memory/1520-670-0x0000000005850000-0x0000000005862000-memory.dmp

Filesize
72KB

Download
memory/1520-970-0x0000000007480000-0x0000000007642000-memory.dmp

Filesize
1.8MB

Download
memory/1520-1031-0x0000000007B80000-0x00000000080AC000-memory.dmp

Filesize
5.2MB

Download
memory/1520-623-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1692-939-0x0000000005860000-0x0000000005882000-memory.dmp

Filesize
136KB

Download
memory/1692-968-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/1692-938-0x0000000005A20000-0x0000000006048000-memory.dmp

Filesize
6.2MB

Download
memory/1692-940-0x0000000006150000-0x00000000061B6000-memory.dmp

Filesize
408KB

Download
memory/2528-693-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/4356-965-0x00000000006D0000-0x0000000000B8E000-memory.dmp

Filesize
4.7MB

Download
memory/4356-967-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/4356-969-0x0000000005560000-0x000000000566A000-memory.dmp

Filesize
1.0MB

Download
memory/4608-586-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-588-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-540-0x0000000004CC0000-0x0000000004E3C000-memory.dmp

Filesize
1.5MB

Download
memory/4608-576-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-556-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-550-0x0000000004B50000-0x0000000004B6C000-memory.dmp

Filesize
112KB

Download
memory/4608-558-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-503-0x0000000004C20000-0x0000000004CBC000-memory.dmp

Filesize
624KB

Download
memory/4608-584-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-560-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-562-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-564-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-566-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-552-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-570-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-572-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-574-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-582-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-500-0x0000000000090000-0x000000000033E000-memory.dmp

Filesize
2.7MB

Download
memory/4608-554-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-568-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-578-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-551-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4608-580-0x0000000004B50000-0x0000000004B65000-memory.dmp

Filesize
84KB

Download
memory/4852-498-0x0000000000100000-0x0000000000A8F000-memory.dmp

Filesize
9.6MB

Download
memory/5248-455-0x00007FF6137C0000-0x00007FF613FD7000-memory.dmp

Filesize
8.1MB

Download
memory/5608-258-0x00007FFE1F030000-0x00007FFE1F032000-memory.dmp

Filesize
8KB

Download
memory/5608-256-0x00007FFE1F580000-0x00007FFE1F582000-memory.dmp

Filesize
8KB

Download
memory/5608-435-0x00000220B4A30000-0x00000220B4A9B000-memory.dmp

Filesize
428KB

Download
memory/5608-261-0x00007FFE1D320000-0x00007FFE1D322000-memory.dmp

Filesize
8KB

Download
memory/5608-257-0x00007FFE1F590000-0x00007FFE1F592000-memory.dmp

Filesize
8KB

Download
memory/5608-262-0x00007FF6137C0000-0x00007FF613FD7000-memory.dmp

Filesize
8.1MB

Download
memory/5608-255-0x00007FFE1F570000-0x00007FFE1F572000-memory.dmp

Filesize
8KB

Download
memory/5608-290-0x00000220B4A30000-0x00000220B4A9B000-memory.dmp

Filesize
428KB

Download
memory/5608-259-0x00007FFE1F040000-0x00007FFE1F042000-memory.dmp

Filesize
8KB

Download
memory/5608-260-0x00007FFE1D310000-0x00007FFE1D312000-memory.dmp

Filesize
8KB

Download
memory/5708-704-0x0000000000E10000-0x00000000014C4000-memory.dmp

Filesize
6.7MB

Download
memory/5872-707-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/5892-700-0x00000000004A0000-0x0000000000B50000-memory.dmp

Filesize
6.7MB

Download