Overview

overview

10

Static

static

3

ff01b5545f...50.exe

windows7-x64

10

ff01b5545f...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2024, 14:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ff01b5545fe20fa6de5ce06212a573e90451ddc2f5da8e7a0234285af729b050.exe

  • Size

    2.0MB

  • MD5

    e20eb29aa454b5381c11c68d875a6925

  • SHA1

    930c635fbfffa29ff2c58c665a7e3404c932f2e0

  • SHA256

    ff01b5545fe20fa6de5ce06212a573e90451ddc2f5da8e7a0234285af729b050

  • SHA512

    4a491b89a7f186eda3efbfeeaefaa1ced0eeca39c987606648d7a1ae62b1939ddab79f48cd725221a36da948449833f868f1ab2aff992061f884893c3a0b6206

  • SSDEEP

    49152:6EB87SJq3vxVDWRkwaxgtPtIorS0+Um6XyNPTVKejl:6EB81yXautPeorSGTSEex

Score
10/10
discoveryevasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 38 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 64 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 64 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 64 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 54 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff01b5545fe20fa6de5ce06212a573e90451ddc2f5da8e7a0234285af729b050.exe
    "C:\Users\Admin\AppData\Local\Temp\ff01b5545fe20fa6de5ce06212a573e90451ddc2f5da8e7a0234285af729b050.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2496
    • C:\Users\Admin\AppData\Local\Temp\4212945740\backup.exe
      C:\Users\Admin\AppData\Local\Temp\4212945740\backup.exe C:\Users\Admin\AppData\Local\Temp\4212945740\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2668
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2740
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1844
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:280
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1416
          • C:\Program Files\7-Zip\update.exe
            "C:\Program Files\7-Zip\update.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2696
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1420
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2372
            • C:\Program Files\Common Files\Microsoft Shared\data.exe
              "C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1596
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1828
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3104
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:4012
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:5816
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Checks BIOS information in registry
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:6732
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                    PID:7928
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4188
                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetWindowsHookEx
                  PID:4964
                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:3132
                • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:6688
              • C:\Program Files\Common Files\Services\backup.exe
                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                6⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3384
              • C:\Program Files\Common Files\SpeechEngines\backup.exe
                "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                6⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1280
                • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:5572
              • C:\Program Files\Common Files\System\backup.exe
                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                6⤵
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4524
            • C:\Program Files\DVD Maker\backup.exe
              "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
              5⤵
              • Modifies visibility of file extensions in Explorer
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:2240
              • C:\Program Files\DVD Maker\de-DE\backup.exe
                "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                6⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3944
              • C:\Program Files\DVD Maker\en-US\backup.exe
                "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetWindowsHookEx
                PID:3308
              • C:\Program Files\DVD Maker\es-ES\backup.exe
                "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetWindowsHookEx
                PID:4532
              • C:\Program Files\DVD Maker\fr-FR\backup.exe
                "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                6⤵
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5800
              • C:\Program Files\DVD Maker\it-IT\backup.exe
                "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Identifies Wine through registry keys
                PID:6744
              • C:\Program Files\DVD Maker\ja-JP\backup.exe
                "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                6⤵
                  PID:7872
              • C:\Program Files\Google\backup.exe
                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                5⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3984
                • C:\Program Files\Google\Chrome\backup.exe
                  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4780
              • C:\Program Files\Internet Explorer\data.exe
                "C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\
                5⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4124
                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                  6⤵
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:7668
              • C:\Program Files\Java\backup.exe
                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetWindowsHookEx
                PID:4808
              • C:\Program Files\Microsoft Games\backup.exe
                "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Identifies Wine through registry keys
                • System Location Discovery: System Language Discovery
                PID:6128
              • C:\Program Files\Microsoft Office\backup.exe
                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Identifies Wine through registry keys
                • System Location Discovery: System Language Discovery
                PID:6932
              • C:\Program Files\Mozilla Firefox\backup.exe
                "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                5⤵
                  PID:8076
              • C:\Program Files (x86)\backup.exe
                "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                4⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2428
                • C:\Program Files (x86)\Adobe\backup.exe
                  "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                  5⤵
                  • Modifies visibility of file extensions in Explorer
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1928
                  • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                    "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                    6⤵
                    • Modifies visibility of file extensions in Explorer
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1616
                    • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                      "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:3524
                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:892
                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                        8⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • System Location Discovery: System Language Discovery
                        PID:5740
                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                        8⤵
                        • Checks BIOS information in registry
                        • Identifies Wine through registry keys
                        • System Location Discovery: System Language Discovery
                        PID:6680
                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                        8⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Identifies Wine through registry keys
                        • System Location Discovery: System Language Discovery
                        PID:7532
                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4904
                    • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:5372
                • C:\Program Files (x86)\Common Files\backup.exe
                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                  5⤵
                  • Modifies visibility of file extensions in Explorer
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:3108
                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1768
                  • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4880
                  • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                    "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:5384
                  • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                    "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • System Location Discovery: System Language Discovery
                    PID:6340
                  • C:\Program Files (x86)\Common Files\Services\backup.exe
                    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                    6⤵
                    • Identifies Wine through registry keys
                    PID:7384
                • C:\Program Files (x86)\Google\backup.exe
                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:1176
                • C:\Program Files (x86)\Internet Explorer\backup.exe
                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:4368
                • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2992
                • C:\Program Files (x86)\Microsoft Office\backup.exe
                  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:3536
                • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Identifies Wine through registry keys
                  • System Location Discovery: System Language Discovery
                  PID:6800
              • C:\Users\backup.exe
                C:\Users\backup.exe C:\Users\
                4⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1604
                • C:\Users\Admin\backup.exe
                  C:\Users\Admin\backup.exe C:\Users\Admin\
                  5⤵
                  • Modifies visibility of file extensions in Explorer
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3252
                  • C:\Users\Admin\Contacts\backup.exe
                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1240
                  • C:\Users\Admin\Desktop\backup.exe
                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2440
                  • C:\Users\Admin\Documents\backup.exe
                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:5640
                  • C:\Users\Admin\Downloads\backup.exe
                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Identifies Wine through registry keys
                    • System Location Discovery: System Language Discovery
                    PID:6668
                  • C:\Users\Admin\Favorites\backup.exe
                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                    6⤵
                      PID:7800
                  • C:\Users\Public\backup.exe
                    C:\Users\Public\backup.exe C:\Users\Public\
                    5⤵
                    • Modifies visibility of file extensions in Explorer
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2236
                    • C:\Users\Public\Documents\backup.exe
                      C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                      6⤵
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:2948
                    • C:\Users\Public\Downloads\backup.exe
                      C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      PID:3400
                    • C:\Users\Public\Music\backup.exe
                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6820
                • C:\Windows\data.exe
                  C:\Windows\data.exe C:\Windows\
                  4⤵
                  • Modifies visibility of file extensions in Explorer
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3664
                  • C:\Windows\addins\backup.exe
                    C:\Windows\addins\backup.exe C:\Windows\addins\
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:4216
                  • C:\Windows\AppCompat\backup.exe
                    C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:2108
                  • C:\Windows\AppPatch\backup.exe
                    C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • System Location Discovery: System Language Discovery
                    PID:6088
                  • C:\Windows\assembly\backup.exe
                    C:\Windows\assembly\backup.exe C:\Windows\assembly\
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Identifies Wine through registry keys
                    • System Location Discovery: System Language Discovery
                    PID:6720
                  • C:\Windows\Branding\backup.exe
                    C:\Windows\Branding\backup.exe C:\Windows\Branding\
                    5⤵
                      PID:7888
              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2692
              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                2⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:1856
              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2920
              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2332
              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2416
              • C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\backup.exe
                C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1204
                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\CRX_INSTALL\backup.exe
                  C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\CRX_INSTALL\
                  3⤵
                  • Modifies visibility of file extensions in Explorer
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2952
              • C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\backup.exe
                C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1648
                • C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\CRX_INSTALL\backup.exe
                  C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\CRX_INSTALL\backup.exe C:\Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\CRX_INSTALL\
                  3⤵
                  • Modifies visibility of file extensions in Explorer
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1484
              • C:\Users\Admin\AppData\Local\Temp\VBE\backup.exe
                C:\Users\Admin\AppData\Local\Temp\VBE\backup.exe C:\Users\Admin\AppData\Local\Temp\VBE\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3076
              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                2⤵
                • Modifies visibility of file extensions in Explorer
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3680

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\PerfLogs\Admin\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    f5a64a583535193badb7327647c1da1c

                    SHA1

                    fa51cfda0f7aa5811db2e665cfffa3a5fe078a02

                    SHA256

                    6554351ee996e6b2c9be4d4ff9865002db041ce903e38a52070256ae92640f77

                    SHA512

                    8fdaab27b91f14ca9b9fb9a637400bc80b02aec4ccea53591843b1615d71effdeaff150a7df4851d121b3f7f670bee43d396a18da7e975ece50a13184b0e7012

                    Download Submit

                  • C:\PerfLogs\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    3aee765026a23ad2ae25d0e90da6e0b5

                    SHA1

                    68becdaf725a1601ed7202f8fd8cfb6f437921b7

                    SHA256

                    95b99cda8529309b4c4e72c0ab4946a7e321968718ba48f3ac8ac21bb385a560

                    SHA512

                    1e2c24227520cdd91b02b2218431ed3e839f6946cc87ccf0011edaef6099119a9cbfc59e9cbd388d481dda57f7b33758273aa6118fc87442b8d10ba7ddfca5a4

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                    Filesize

                    2.0MB

                    MD5

                    e2ea2828f2a30f4e62136de60d002f13

                    SHA1

                    830ff1f472d40400d0a4a1f10e0f261b0f1a51da

                    SHA256

                    26c57b41707bbfd3d6de56e1b4ba2f9997bf45757532487f0df7202a2328af70

                    SHA512

                    ed430262aff60c4a1077132ca7dd72778baeb67a8aab8311e4609517c3ef84c760cd80f20b361591bd300d2e8b10cac8e3c7e4205a6fba4671b869e56c306659

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\temp.zip
                    Filesize

                    22B

                    MD5

                    76cdb2bad9582d23c1f6f4d868218d6c

                    SHA1

                    b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                    SHA256

                    8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                    SHA512

                    5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\temp.zip
                    Filesize

                    2.0MB

                    MD5

                    28a2430fd74b45dee6b01663423f4523

                    SHA1

                    8b17da7a97ccef0e94f3eb9fbf7b0e6fab21df6b

                    SHA256

                    f44758d8c25a057fec42693376e355ecbcedec21e2fc696574603239f8c675af

                    SHA512

                    5155fee672a10bb9ed640ef4a36318943bac28c7c500272a132cae407f4f84961d1875ec140d61db02ec0aa736ad682ac4f15ee37842d14b6faca6843221da6e

                    Download Submit

                  • C:\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    37cbdac75b7dc97e5f47fa6d8ff5f864

                    SHA1

                    7fb8f656b32e45aa1dcff734a3613e2510b6c14a

                    SHA256

                    873c23bd155d935c798d26d79ed2f8fada520a8c71fd6ac8fcede147f86b2a42

                    SHA512

                    26412253f8ce3d712cfe2e298af89841feb6ac065a52168ed4f19c1bdb653c051cf581546e75e531631414ca9f4aaf26bbf17364877dd807ef020e2be105929e

                    Download Submit

                  • \Program Files (x86)\Adobe\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    6eb1088f15c251e8de26712197a92c7f

                    SHA1

                    2303d94888428c9cf8b660c8d2648424a4f4adce

                    SHA256

                    5dd5c06541a3e405df8ede4aef5fe347478f3f1c2b0b04f4bd8476fe22d23884

                    SHA512

                    53411e07c4274eee77b6ea00bc8f4e4a2bf1ede286e90191ac241b1f22833465a2731b1fd3e579e2b10f9065f7b1e1d314605e13f4bdac159fb718577bf1de84

                    Download Submit

                  • \Program Files (x86)\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    dc42e7e5d27dcc6dd3b3aec413e69652

                    SHA1

                    07fe17d1248feb7f9f1bed309d332a1fdc821d7b

                    SHA256

                    0ade94658b5509929454efb77ed1575e5feaf6a723ac86a5f844af163927a1c5

                    SHA512

                    ec3ced16f1a1e43cf068733f0587c975f615898d77ea19093db6be3eca68aabb6560b8436f1dc2a5efcd78fe3f36aef560933bfbe0f556aec163d10145aac780

                    Download Submit

                  • \Program Files\7-Zip\Lang\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    18d08733e0d0703db6cb2f4465658426

                    SHA1

                    cf3e02e5b0a77848da44d27834dda134e9f0060b

                    SHA256

                    d60a667c8fdcd80ab10cb418459e024b525e2c989e8592ebb50b74c56777e629

                    SHA512

                    a3345a27377c87efa5bca91f791cea4d36bc4a59938e75ad08023b690ade835f53348c38af1d27ef741c264de4ebe3dc28284c9c45b76b16290afbd952a007a4

                    Download Submit

                  • \Program Files\7-Zip\update.exe
                    Filesize

                    2.0MB

                    MD5

                    949a58279dd8826506d9c2a2eee05a2c

                    SHA1

                    7ef1e390d00b822aa4cf736d0ca2aabd967f89f5

                    SHA256

                    7264dda2f93d55a23ef2ca3f83f3c99ee7a8b8d8c4a0b8896a1b21c7abefcf30

                    SHA512

                    bec29a7748b59d34109ef8c041739dc3cc6b0d8eca4344135ebc44f989104b7c8010c5b03f67c674fe58cd2565cb201a81cfe8cc661c0adc379d7ebc5aa6186a

                    Download Submit

                  • \Program Files\Common Files\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    e0e36ff66c6743e4984e23112c75ad01

                    SHA1

                    867a25938d962fcfabab2a8eab8e78f3545132a9

                    SHA256

                    3c9e87ef3dc41aead59c1b5dabf440176078829b2dd2409aec5f365193eb1fdc

                    SHA512

                    0138bd5a7f5f4f90f55e8c0a512da5a12c517b5c3139314c541f350a4b30761e97a4ce2e3bbe94b17b5f6512692d7510039e3641c104d517ce79857a17edd47e

                    Download Submit

                  • \Program Files\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    fb04798eb0ea35642dd20190cce319f0

                    SHA1

                    9333adfdb0ce702efe715f7faee33539ab005b56

                    SHA256

                    94222eab50c082588a735312f82ed14add350cd18e90666226307e0a232676d0

                    SHA512

                    47a30ee330ba9002c9bd45f8b5575a5a5b62617d81b9c16035a46f2594cdf3d40518c1624c0ed938b47b2851e9e05776203b2d40e0e6d4b9625dcc1bbb14d589

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\4212945740\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    75091ed63b155cab571502dfc916ccd3

                    SHA1

                    25cd8c508c3625f15941ba07c832b50fb506cb8d

                    SHA256

                    7b93cf1d49454e510473332cf00d36f573d31c9c31e3812c488c991768245e0a

                    SHA512

                    40a08f68662cd08ba66e15c0ddac882f22c026bb47cd2bd1fa639f40d53d95759d5dedc80e9cd049156da7b5a465bfa331f380173b576d7a0b5cf943e9ba8766

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    abcbba5a0a4c664d14aa377836e9b833

                    SHA1

                    0c93e523b72b81c4ec6cf20ec40f5c5286ceae19

                    SHA256

                    b670260e10bf3c4d1a41d4287ae43b613cdc6906b6a1b1902df50cd0e1bf6722

                    SHA512

                    b581ffd6b2e6a23b8ef450f8b9651bf922e1756188226bf3355b95b2c5f4b2e00376bd69d2d8e6d2dfd812934bd59fbd56f3083147304636c242e0226db2abc2

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    93c89ee28af02b94e10d979201107123

                    SHA1

                    df134f99f60fe460b6a3b67342145dc89e656446

                    SHA256

                    222a92bbcfbe57fed4b674f1834f63123f38bf380ba91bae3cf9bfa3f5cbf702

                    SHA512

                    5b5c3a6e2ba9992e77df7df645b5f67603dbadc6f63f53989aa869c829f37eafa10c255fad81b91004cf875f2c1394f8ffad70b9b2f0557d898a72c8bf26b0a8

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    3a5215ef7e7ab1b7573854e4f62bcaba

                    SHA1

                    4943da0c2c2607fd51d47654197617dc0711cf93

                    SHA256

                    404721a08f50b1ed734c95a67cea16edc73a2108bfa3f46427fd3e8b1c847832

                    SHA512

                    bc0bc12f922e23b45f046443b767862158fb20ac8adababc466d612d745e78070119476542e359de16e700772e736285a1eef4717e731af431063a83a7f43413

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    942ed1384625b2327523e991a661aeb2

                    SHA1

                    e9b5131694de4d13f973b27455450aa9df93feea

                    SHA256

                    90c83d6f27ed6487cc6f8bdd97a682562c204e4e6ffeff2854777d36d0a01ffd

                    SHA512

                    34cda932ade08fd9477192780088f18825c881050d47cbafac9a6a820bfa968033ae5c297e6157a0095093b01661e1c746edf55e315c58cad57bc2a5eadd047c

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\CRX_INSTALL\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    0b2928596537092a21208683dec7fea6

                    SHA1

                    1a73bb0d981ebf3332415d088e53e8f955231664

                    SHA256

                    5275b16d2b147ff9c1b7af8e3b077a5b3b1b5c22c2605ff5f4a5498733a99907

                    SHA512

                    69be140a9823f0150658b237f0195001e8cd122d72ba88ac8d8262c7b40b3bdc8d723fbd65425980d149dc2dc2920366d4ef545bcb332acc918d9c81ae201958

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\scoped_dir2628_1011541308\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    64d777dd699a5d9dec1c96d85d223a7a

                    SHA1

                    e2ef1670ddf2966ad951ea49a4b44868627897b5

                    SHA256

                    f4a9d904dd8ae974ddac62b9c30dee02dc78d5807fec8ad954458637dfc93667

                    SHA512

                    d74eb3c90f602f81b78a6d20958d73292a7802ec02495e774084c42c0db46b2c38ba3b21dccfd38d38efefb4e5bf67b55b01ef8a2fa2810c7a4bb6b3f49d15a9

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\scoped_dir2628_520876621\backup.exe
                    Filesize

                    2.0MB

                    MD5

                    0b5cc7feb5dd17381857abc630b9c659

                    SHA1

                    2562af90c7e2a0c564e0b794878a583732e1b557

                    SHA256

                    3446efd3af5bce4c93d84553abaaa9e06187a7af584e7befb757027df1521173

                    SHA512

                    dc2cb819100b4aefa801ba24e310e946a104828e48b45fe8597398ada48cfbf1fdafaf682de5ac2cb753a3c92f66755ccf51e326b742d9b69201228830bd3945

                    Download Submit

                  • memory/280-95-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/280-124-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1204-227-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1416-312-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1416-242-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1416-187-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1416-445-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1416-373-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1420-209-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1484-326-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1484-336-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1596-303-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1596-434-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1596-362-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1604-376-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1604-447-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1604-320-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1616-377-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1616-321-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1648-289-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1648-328-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1828-356-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1844-98-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1844-126-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1844-66-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1844-93-0x0000000005500000-0x0000000005997000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1844-94-0x0000000005500000-0x0000000005997000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1856-50-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1856-100-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1856-92-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1928-319-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/1928-290-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2240-327-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2240-404-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2332-131-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2372-325-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2372-270-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2372-397-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2416-156-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2428-256-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2428-446-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2428-313-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2428-374-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-34-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-52-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-11-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-255-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-444-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-26-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-64-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-528-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-186-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-13-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-24-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-36-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-311-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-0-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-372-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-91-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-47-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-49-0x0000000005560000-0x00000000059F7000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-127-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-396-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-324-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-269-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-67-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-211-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-145-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-14-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2668-46-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2692-51-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2696-210-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-234-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-382-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-35-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-152-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-278-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-68-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-65-0x00000000054D0000-0x0000000005967000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-97-0x00000000054D0000-0x0000000005967000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-96-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2740-342-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2920-79-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2920-112-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2952-226-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/3076-398-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/3108-424-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/3252-425-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/3384-407-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/3524-423-0x0000000000400000-0x0000000000897000-memory.dmp

                    Filesize

                    4.6MB

                    Download