Overview

overview

10

Static

static

3

7f9c4f9966...f4.exe

windows7-x64

10

7f9c4f9966...f4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 15:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4.exe

  • Size

    3.1MB

  • MD5

    03bb6c45bf7f0ce8caa6c8ba6ca33509

  • SHA1

    f59d3d9d070984d3bd3e4bd7c903990b204ed554

  • SHA256

    7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4

  • SHA512

    0e99313226eb3df882a9372820532d71ebe95616f7290e4eb08256681af7bf8826c66cea34cd50f89b1dc34af145fa7803d036d64d58a45855e998982d4259be

  • SSDEEP

    49152:qmZuKkpYpaS4Zqf63VQkUfHZjTvfS1REpnlt+nzZWF5whsj1NbyE5Hd:qeg4Cqf63Vsf5jTvfeEntzohs5sE

Score
10/10
amadeygcleanerlummastealcxworm9c9aa5stokdiscoveryevasionexecutionloaderpersistencepyinstallerratstealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

Version

5.0

C2

45.200.148.155:5050

returns-male.gl.at.ply.gg:19831
Mutex

i5ZVKLKJz2PVTovK

Attributes
  • Install_directory

    %AppData%

  • install_file

    SecurityHealthSystray.exe

aes.plain
aes.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 4 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4.exe
    "C:\Users\Admin\AppData\Local\Temp\7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
        "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
          "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3628
      • C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe
        "C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1704
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9Qk4n8B.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4120
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5100
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2532
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5740
        • C:\Users\Admin\AppData\Local\Temp\ahtwry.exe
          "C:\Users\Admin\AppData\Local\Temp\ahtwry.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ahtwry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3252
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ahtwry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\SecurityHealthSystray.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3720
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Local\SecurityHealthSystray.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5848
      • C:\Users\Admin\AppData\Local\Temp\1013459001\355e0b0c1a.exe
        "C:\Users\Admin\AppData\Local\Temp\1013459001\355e0b0c1a.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:948
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 1484
          4⤵
          • Program crash
          PID:516
      • C:\Users\Admin\AppData\Local\Temp\1013460001\653523b902.exe
        "C:\Users\Admin\AppData\Local\Temp\1013460001\653523b902.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:736
      • C:\Users\Admin\AppData\Local\Temp\1013461001\52fee6dc39.exe
        "C:\Users\Admin\AppData\Local\Temp\1013461001\52fee6dc39.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:100
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2660
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3272
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2196
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:932
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08fc4d17-8162-4c98-ad0a-8ab4142cc1da} 932 "\\.\pipe\gecko-crash-server-pipe.932" gpu
              6⤵
                PID:636
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c4326a4-6629-47bf-b6de-1a737681f316} 932 "\\.\pipe\gecko-crash-server-pipe.932" socket
                6⤵
                  PID:1272
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2652 -childID 1 -isForBrowser -prefsHandle 3168 -prefMapHandle 2900 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22554e09-a224-42b5-bad4-4b3f3627d5ff} 932 "\\.\pipe\gecko-crash-server-pipe.932" tab
                  6⤵
                    PID:1252
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7281e3d0-4d38-434f-bf4e-513df204499d} 932 "\\.\pipe\gecko-crash-server-pipe.932" tab
                    6⤵
                      PID:2964
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4752 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4704 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cca8a6e-9090-446b-a66c-3b207f16faf3} 932 "\\.\pipe\gecko-crash-server-pipe.932" utility
                      6⤵
                      • Checks processor information in registry
                      PID:5464
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5104 -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 4140 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab8917d4-f083-4f75-9505-3b8c184cac49} 932 "\\.\pipe\gecko-crash-server-pipe.932" tab
                      6⤵
                        PID:5996
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5180 -prefMapHandle 4948 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab48e16c-adaa-4e21-8135-7f3a951fb890} 932 "\\.\pipe\gecko-crash-server-pipe.932" tab
                        6⤵
                          PID:6024
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5524 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {690f78f6-e8f4-448a-8471-c44639dc95b1} 932 "\\.\pipe\gecko-crash-server-pipe.932" tab
                          6⤵
                            PID:6056
                    • C:\Users\Admin\AppData\Local\Temp\1013462001\e7f3bc5d81.exe
                      "C:\Users\Admin\AppData\Local\Temp\1013462001\e7f3bc5d81.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:516
                    • C:\Users\Admin\AppData\Local\Temp\1013463001\e21c38821f.exe
                      "C:\Users\Admin\AppData\Local\Temp\1013463001\e21c38821f.exe"
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5960
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 632
                        4⤵
                        • Program crash
                        PID:5680
                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4816
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 948 -ip 948
                  1⤵
                    PID:3412
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5960 -ip 5960
                    1⤵
                      PID:2608
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2004
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3580
                    • C:\Users\Admin\AppData\Local\SecurityHealthSystray.exe
                      C:\Users\Admin\AppData\Local\SecurityHealthSystray.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4360

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Modify Registry

                    3
                    T1112

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Discovery

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      968cb9309758126772781b83adb8a28f

                      SHA1

                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                      SHA256

                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                      SHA512

                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\download[1].htm
                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      18KB

                      MD5

                      1b2f3d3cff3118f81a18b5a428159a4c

                      SHA1

                      a377c3930174ccfe70a86da655392058d65d6a0b

                      SHA256

                      af01630fcd2b3aa3a180840505b4b60dc2be8b442174bd453262b9de1a160470

                      SHA512

                      e38bf9a115419e38dd9fc816d2b96dc273b88c54169f2c9a58c1f13cc30367e5608c049e0f90a3068f39be5c7b7a3ac4c0763cb3a8a3260894c66f39a6c21c7e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      18KB

                      MD5

                      b63fe987b80dc36bba648d780d05af1a

                      SHA1

                      1694b19a6959748191ecfc28ff05fcf9c70fe421

                      SHA256

                      e651e0f632c0e3b9b595d4c574070c25ecf66b0575df1e96ee5b11ba5bfaeaaa

                      SHA512

                      40c60c43f3c7cdf2553513e46fe218670e8ffce2703cda81ca7044fa5b56f8ee5b7df5501357bbca092957d40b080ac085f368a78c9e9e097caf3b6180306692

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      18KB

                      MD5

                      b89dd780af5fecefaf79553da752b54f

                      SHA1

                      d5868b95bae9fa5ab1abb8b31264b62c48c35dc2

                      SHA256

                      e82b35ece89ff408f716777da06bfaecdc55937dd8d30735d5d435765cc22c24

                      SHA512

                      3065e2cac47d9380e4dbf722c60f0df4a653eacce708ef4678d8304fb49d91140828b484530b404d5f19f40f46d071979245b6ba418f0ca9a993e9fabdea7a24

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      18KB

                      MD5

                      6bac9862b9fa27892b0e3fd4819ca8c0

                      SHA1

                      0ee09d4e7be62bbca44669f7bda3f960ae9a81ea

                      SHA256

                      ed8e0f225ded57299c19a20ac0e1bb8e9b8a2f905f383638e539da35cd2b2e05

                      SHA512

                      6261491c5c006a0cbd40e763d740e8b29cad201da4ebcbd40379d2f7eab26222aa8ed7cd42ba795cced80a8094c9c93cec3d89d2865cb1a6b4406513c69fceb6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      9b80cd7a712469a4c45fec564313d9eb

                      SHA1

                      6125c01bc10d204ca36ad1110afe714678655f2d

                      SHA256

                      5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                      SHA512

                      ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      34f595487e6bfd1d11c7de88ee50356a

                      SHA1

                      4caad088c15766cc0fa1f42009260e9a02f953bb

                      SHA256

                      0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                      SHA512

                      10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      a7cc007980e419d553568a106210549a

                      SHA1

                      c03099706b75071f36c3962fcc60a22f197711e0

                      SHA256

                      a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

                      SHA512

                      b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json.tmp
                      Filesize

                      19KB

                      MD5

                      e2006d3d3b964f57c29ca5714e8fab09

                      SHA1

                      c081cb552bf83f39242e2598d1237911b343fc9f

                      SHA256

                      a626cc0444c41687867d2253c1de3519c5c6f9a007e29341a989a0bb45c136f0

                      SHA512

                      4ccf5fb0f2c40366f50eafabc5e5ead973241115f9e3a4ef9c37230ccd894175686571c6624a706be1501c32411a0328011e8cf5e9ad4dd22751a248b6e94f9a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                      Filesize

                      13KB

                      MD5

                      25c7eb03da2879ee422788c08ae5434e

                      SHA1

                      51b195b55f595ae66700c1cafc9c915f0f2aaf3b

                      SHA256

                      c550586c92619666efb5cfd931e070f8460ea90326d93ab8df35b5eb793d6951

                      SHA512

                      0d39d6fa5bfce70d7d2478e3cb3853339adde760eaef8637532c0c9d6f6e90316e0b6ae4ae148d040a9ac2185e5b4f5c8581d92a892e340d20ca0357cdba5caa

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
                      Filesize

                      9.9MB

                      MD5

                      53306653e88891da35bdfc1330a2dafd

                      SHA1

                      0870df54ca24e32bf88ccf00d7dd0ada3a0ea096

                      SHA256

                      fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09

                      SHA512

                      930ff27fc7377eaf0097cc6430f2c5486336c398a7ae08fadbcb0af62490b96c0b9ec3d36455c04e5a79d2405fc0c6f1f6a44b0298f3b6ff46f2a6c591aa51ba

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe
                      Filesize

                      1.9MB

                      MD5

                      5d88053a8fa89daf50a22f3e7130b84f

                      SHA1

                      376315c3b18c6d410a615dcc18dff4529f44ef9b

                      SHA256

                      78d2025e6bfce4ee78142552e30d2eb07c9bb7901ec6407ab8ce5bba72c13074

                      SHA512

                      f60af0d664d5a13555c21891a02fab76d7c63d45b6497e8c7da1cad3cc89223d1578c9b0a394fd23bb650777eb8f295cb372519db0c22a7061c0a4a0872261eb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013459001\355e0b0c1a.exe
                      Filesize

                      1.7MB

                      MD5

                      2e294f3db1a3b1f0624b69d47ba3456c

                      SHA1

                      082c1d3d3a7363b86db51d01e23959f72eaf740c

                      SHA256

                      03100a9686a78171ad87a164d17b5cf4defc92736db32352fc16bf60e5d731fc

                      SHA512

                      c60875c1825ec998996de35c52cff8b03c0b98631578c93bce026c9f580494fd2df216bbbe6db13832b67a4f0f21d045926041ce3865f87508c5bdd422e753e7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013460001\653523b902.exe
                      Filesize

                      1.7MB

                      MD5

                      a7af58fe0da7ef19da6ad1ce8376597e

                      SHA1

                      891eb45d3c52f186cd2cfb03997b996c4535bf26

                      SHA256

                      b8b2986f268c6ba53ea30d750092c0a26e7fe8cdfb74a3ff3be9513ad05b716d

                      SHA512

                      7c0d7d30b7c6a013378ab2f744d45b218c5be00fc20bfc00cd983a13e60645e8dc311278c433d842151043408fb316a00c20cb655b13426dcd7e6acfdcbb25c5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013461001\52fee6dc39.exe
                      Filesize

                      950KB

                      MD5

                      58d8b4340fa9ca05e2ecc82281f6ba30

                      SHA1

                      bf7fdb9954f4763c5bd0d6f45e5df9e2fa4326e5

                      SHA256

                      95cd445851e76e32539034fb5614d3bd2d04747479941dda234a0175e78dc2a4

                      SHA512

                      0d8c69ff14216d151151a935a3ff76679e219f551badb37fa441e189c7364a68e03cb4b65f8400238fddd48e862b004a7b7163043fb1a524feba30da3d8e74ff

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013462001\e7f3bc5d81.exe
                      Filesize

                      2.7MB

                      MD5

                      0c628411b34cd221d309d406683deca1

                      SHA1

                      5f8be3da5456806706c322c3c83aaa60c2d5f1f3

                      SHA256

                      0332638fac22e2222292b66defa0c78ac428d160e44802ca89cfe0b898f70620

                      SHA512

                      40c2c39c84d56d4cd3a0541fefb04738eab0e19e9aef3baa0f9ffff89b264cddd33fa056f9a23dfdf92c6dddb5dc6334dcead943d634143bbd0d2601b3332fb9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1013463001\e21c38821f.exe
                      Filesize

                      1.9MB

                      MD5

                      e96cd9e1c8cbc927c9c445e155d5bd75

                      SHA1

                      6c8d7a80cb4635fda0f7b799ace942dcd10b3700

                      SHA256

                      9f1169888c4c2acd65e79928bb27a686204fa3b622b921a7ee56c7a735924eb6

                      SHA512

                      419cb0650a718f7356335745a64d441d8693c48181692bdfb22da508fa993e93772f5ee89ae5085e5ae3d04f28936b57e12e6704291be6acc45041744ba7f413

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\VCRUNTIME140.dll
                      Filesize

                      94KB

                      MD5

                      a87575e7cf8967e481241f13940ee4f7

                      SHA1

                      879098b8a353a39e16c79e6479195d43ce98629e

                      SHA256

                      ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                      SHA512

                      e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\_bz2.pyd
                      Filesize

                      78KB

                      MD5

                      bcf0d58a4c415072dae95db0c5cc7db3

                      SHA1

                      8ce298b7729c3771391a0decd82ab4ae8028c057

                      SHA256

                      d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a

                      SHA512

                      c54d76e50f49249c4e80fc6ce03a5fdec0a79d2ff0880c2fc57d43227a1388869e8f7c3f133ef8760441964da0bf3fc23ef8d3c3e72ce1659d40e8912cb3e9bc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\_ctypes.pyd
                      Filesize

                      116KB

                      MD5

                      41a9708af86ae3ebc358e182f67b0fb2

                      SHA1

                      accab901e2746f7da03fab8301f81a737b6cc180

                      SHA256

                      0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf

                      SHA512

                      835f9aa33fdfbb096c31f8ac9a50db9fac35918fc78bce03dae55ea917f738a41f01aee4234a5a91ffa5bdbbd8e529399205592eb0cae3224552c35c098b7843

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\_lzma.pyd
                      Filesize

                      150KB

                      MD5

                      ba3797d77b4b1f3b089a73c39277b343

                      SHA1

                      364a052731cfe40994c6fef4c51519f7546cd0b1

                      SHA256

                      f904b02720b6498634fc045e3cc2a21c04505c6be81626fe99bdb7c12cc26dc6

                      SHA512

                      5688ae25405ae8c5491898c678402c7a62ec966a8ec77891d9fd397805a5cfcf02d7ae8e2aa27377d65e6ce05b34a7ffdedf3942a091741af0d5bce41628bf7d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\_socket.pyd
                      Filesize

                      73KB

                      MD5

                      79c2ff05157ef4ba0a940d1c427c404e

                      SHA1

                      17da75d598deaa480cdd43e282398e860763297b

                      SHA256

                      f3e0e2f3e70ab142e7ce1a4d551c5623a3317fb398d359e3bd8e26d21847f707

                      SHA512

                      f91fc9c65818e74ddc08bbe1ccea49f5f60d6979bc27e1cdb2ef40c2c8a957bd3be7aea5036394abab52d51895290d245fd5c9f84cc3cc554597ae6f85c149e1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\base_library.zip
                      Filesize

                      812KB

                      MD5

                      ab6d3149a35e6baddf630cdcefe0dab5

                      SHA1

                      44cdb197e8e549a503f6cfcb867a83bf2214d01c

                      SHA256

                      1d91fa604893531393f83e03e68eb97d2c14c2d957ed33877d2b27b7c30ce059

                      SHA512

                      28a882e86d92d42ff983b68445cc90431c2b65b7ec3abbffb5585a9750d67b8b52a1361e20d4d80ca4a30b927fe543a2e9c9a65c1846e42a112b511ddc59545a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\libffi-7.dll
                      Filesize

                      32KB

                      MD5

                      eef7981412be8ea459064d3090f4b3aa

                      SHA1

                      c60da4830ce27afc234b3c3014c583f7f0a5a925

                      SHA256

                      f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                      SHA512

                      dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\pyexpat.pyd
                      Filesize

                      187KB

                      MD5

                      f3630fa0ca9cb85bfc865d00ef71f0aa

                      SHA1

                      f176fdb823417abeb54daed210cf0ba3b6e02769

                      SHA256

                      ac1dfb6cdeeadbc386dbd1afdda4d25ba5b9b43a47c97302830d95e2a7f2d056

                      SHA512

                      b8472a69000108d462940f4d2b5a611e00d630df1f8d6041be4f7b05a9fd9f8e8aa5de5fe880323569ac1b6857a09b7b9d27b3268d2a83a81007d94a8b8da0ff

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\python310.dll
                      Filesize

                      4.2MB

                      MD5

                      c6c37b848273e2509a7b25abe8bf2410

                      SHA1

                      b27cfbd31336da1e9b1f90e8f649a27154411d03

                      SHA256

                      b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8

                      SHA512

                      222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\_MEI12282\select.pyd
                      Filesize

                      25KB

                      MD5

                      431464c4813ed60fbf15a8bf77b0e0ce

                      SHA1

                      9825f6a8898e38c7a7ddc6f0d4b017449fb54794

                      SHA256

                      1f56df23a36132f1e5be4484582c73081516bee67c25ef79beee01180c04c7f0

                      SHA512

                      53175384699a7bb3b93467065992753b73d8f3a09e95e301a1a0386c6a1224fa9ed8fa42c99c1ffbcfa6377b6129e3db96e23750e7f23b4130af77d14ac504a0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqyqflkj.yvy.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      Filesize

                      3.1MB

                      MD5

                      03bb6c45bf7f0ce8caa6c8ba6ca33509

                      SHA1

                      f59d3d9d070984d3bd3e4bd7c903990b204ed554

                      SHA256

                      7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4

                      SHA512

                      0e99313226eb3df882a9372820532d71ebe95616f7290e4eb08256681af7bf8826c66cea34cd50f89b1dc34af145fa7803d036d64d58a45855e998982d4259be

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ahtwry.exe
                      Filesize

                      225KB

                      MD5

                      df308cc3c6aae07ad391026f96c8948d

                      SHA1

                      6d694961718b2ee81680381faf76aa90e1e2af1c

                      SHA256

                      1ffd9cc6ba55221068a15ef8dfbbab5e2653f6434670dd2945d7c73f5d74567c

                      SHA512

                      f6a0757e8d7348d768ecad3262c3da2bc050b392c15f830bc0b8d12fb9f3b41fd5bf05346a26b14d85fc7cf53d43c821345f427fe320a33c22b438ee24f4ded5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk
                      Filesize

                      876B

                      MD5

                      324d4bc7ef78e7114d8d079054afb2af

                      SHA1

                      32eb457da5f727cf6f92fa4f08baed1fc66c38e5

                      SHA256

                      ae820b6e4a46398448aa526c0f9c2f811745c2e7c244621ce46ae5c8d6cf2487

                      SHA512

                      5a7c23cd283365945b3865f1283cdf590e3de304037bcd21d340e0e422c4739088358f8ac88808027598a2dbd17e3f6df187f658c6d4a5a42f93c31d39f45f5d

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                      Filesize

                      6KB

                      MD5

                      ed4e6d3d9a71a0c2e7110fa9e6dd7303

                      SHA1

                      658fa116131a77835d306fcfcbfb3e6afb65fe7a

                      SHA256

                      6c3c9c50f0cc15a8ed39ca40f0537108e3ad052b8e06203f0aff05cb8104354d

                      SHA512

                      3ef2ef051778b86a790af11f4d1a70a3212402b0da5a3fa8574ca4c7d37647aa786b9946a1b8085f9381d60ca43d75eced4e2b782e03c0ec3119fdd3461e6d68

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                      Filesize

                      8KB

                      MD5

                      3f299d8f4c319cb631bb604779b1f941

                      SHA1

                      7eb5f069eb6d2b17df0229ee1603c3371de5764c

                      SHA256

                      0b3085c30602920a6c6cad756cf7b79bf99799c85f212243d842f442c288edfc

                      SHA512

                      2f4da4a355eb10ebc9b5c0355717257cb6585b36ed1be4a05bf92bbb2e680015c139655aba601b0352baceafb8087bd5abf1f925959c4faff585cd1b5ef30ce0

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      5KB

                      MD5

                      fa4f9beb82a32a9e7bf7dabd398a7f18

                      SHA1

                      e3dd6b9a4826c066d570eebcf7b16e0f044a8aa0

                      SHA256

                      4449944224084e4473984f74141d60b58084c941a3c066ac5c3e5f4b172ca80e

                      SHA512

                      917f6b2e306c6613c5abd20fbcc30b489935f6458bb559970d7ea0d87a7cf3edb78bd17171428c7f2fc31c65e57bfbfd5ea32eba75f5ab72213768a4d2b91fa6

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      15KB

                      MD5

                      6e24d3747c1e9709b7c6ee07b54f5a67

                      SHA1

                      03859eb956771b276dac46da80085f51775426af

                      SHA256

                      568f50d5b28a0290aa2194e5afee2379867d4e7bffbb050bbb27b09e82ef833c

                      SHA512

                      417c0336c8af2ae265bb5016a56a95e1584658a86a4c151e15f43bb039842bf8ddf77874a25c6dd3c4f8e500c0f2eb4e80056b8f48d835a0475f17207f036e0e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      15KB

                      MD5

                      28ab6ffc29b7e5ae4c0bcdd223833582

                      SHA1

                      c6b63ae3ad63a4a82ffc32d00a2df7df007689f2

                      SHA256

                      e9458958c312393448c4e653db59940c7d34707879b284ea7fd9a5f316828104

                      SHA512

                      45ed34b66abc93fa659a42f566a331910e9d7bafefd79f62fa2b660a51f3c3709155c24fa4fbdab6fabcad9d5155db69163e274c0255110f60828eee0c45ecc3

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\158c5349-45d2-48fa-89ef-09b0047fd2e6
                      Filesize

                      27KB

                      MD5

                      ccf5ca666c86330ef58d38723175dd9c

                      SHA1

                      cefbf0742124b27376ff025365c9dfc540c85ccc

                      SHA256

                      bd5262e335e021a96ba430f3dbe4950da521a6e2a7e9d4ac4246aa7321be8e06

                      SHA512

                      dfadc3049b90119a3b064bc7ba9494214f5cf11eb5d095e5206a63d8adf7064ad66727c0c8417737235fdf57e78056b5067de624121cf4ab303c1782a0b82dd4

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\29c38869-cb49-47af-8d1d-3cc9c45606ba
                      Filesize

                      671B

                      MD5

                      fe983be7652b70e95c26658779309376

                      SHA1

                      3cb7ec6d47eac7434213088d72c3f79006e8071f

                      SHA256

                      06ad0275f0d64e15a4b568a2105e2a32ee7c96c39323dc1d18d8c7d091603cd0

                      SHA512

                      723f6081114ef83be1feff7195d4e4aa6698a349b71a25a0d03e5bc3eca900b44a67d8c9b56f2ccffb1f0e51ff3b2fe984e76e10689a5de9917bec1a6aecb875

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\2e8e171f-a784-4f76-8200-c2b4466acd72
                      Filesize

                      982B

                      MD5

                      82aad62102de08cf90531790587658e4

                      SHA1

                      093f3f79e9992163ce2b14c1e95c76b6b023baec

                      SHA256

                      2541deb0db335c7baccca8c01b2d0a5892345fa74809fd402d9e2e0415e725a1

                      SHA512

                      53795a23aaa8b26b8d571b81d27aa812172e11b6de1afcaf670e0e49f7a9b66829e3acf08112b234b6240b3609e6be7e08b0741b3da334f5f193882bf7b17628

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                      Filesize

                      10KB

                      MD5

                      597405b7b3385a04ccc53453b70dc1f4

                      SHA1

                      95236e325f6a0ef8f3a2eb25004d728d20cf90fd

                      SHA256

                      81551d4e24f71f992ffbdfdd674ea1cb337d2ad7de6b0755e345b088764dca0f

                      SHA512

                      0dcc90ef46072e6c338f1399f9d167f4733687a7d4235b2f823c930cd754f76013387ae99be2151c9e24a92e71b1164609b5eb2361ecbe1d0ee97b762e531833

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                      Filesize

                      12KB

                      MD5

                      5835214be7497c6d959135cf585ba6c7

                      SHA1

                      97b1b01f4d529011387d9ea8438bb4b8374dc7e0

                      SHA256

                      1471a8665f0f6ffa2cdf91923d87f671c5d2894fbc6cbe42c77a3e290b3e8fba

                      SHA512

                      2d946c95e43b78a2548d5b1dedaa480a03b36f46895cfd41ee99d562519fea92b58ae5222d62d32b8462149df6fc5eb422c34d6d2e369e437010aaf0063792be

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                      Filesize

                      15KB

                      MD5

                      1ba3a26b059832190bdd18f3855ee1a3

                      SHA1

                      b4417a1542a1639f090f0220df72e7498ee7222b

                      SHA256

                      da3e7b77634e330ef5810651d43cbe6bd907e06f5a72bf9df3c5d3c5d0441a19

                      SHA512

                      435e7049463babeee6c44362b5f8187ca841c31eb6fe9f5e869bc42acb2896119edbdbcea39e2d124c610bdcd13c1caa24ac6549fd8e1767a7e69a70ef2431cd

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                      Filesize

                      10KB

                      MD5

                      46fbc17813ec14c8671cc56c459833ab

                      SHA1

                      bc2925032863129213fb1147c126b31a10371eb7

                      SHA256

                      b65bfae1493b9f7d071e3233c17d73c4f3e7cc53c185ee6215cd441020efd257

                      SHA512

                      3cc41b3b9e32ee4a80191a5e963bb6794ba3dece8fd24b4d08f46612c37ef5de5ec84d7e14f2357114af7176ca7e0eb93bd51aeee49e4edc81af8f71041d862a

                      Download Submit

                    • memory/516-390-0x00000000009F0000-0x0000000000CAA000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/516-779-0x00000000009F0000-0x0000000000CAA000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/516-763-0x00000000009F0000-0x0000000000CAA000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/516-597-0x00000000009F0000-0x0000000000CAA000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/516-588-0x00000000009F0000-0x0000000000CAA000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/736-236-0x00000000001D0000-0x0000000000855000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/736-240-0x00000000001D0000-0x0000000000855000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/944-22-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3874-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-138-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-761-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-24-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-25-0x00000000008A1000-0x0000000000909000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/944-802-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-21-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3880-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3800-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-23-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-385-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-216-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-20-0x00000000008A1000-0x0000000000909000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/944-19-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3869-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3872-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3794-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-3876-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/944-1975-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/948-186-0x0000000000EF0000-0x0000000001370000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/948-261-0x0000000000EF0000-0x0000000001370000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/1704-204-0x0000000006090000-0x00000000060C2000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/1704-217-0x0000000006D00000-0x0000000006DA3000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/1704-220-0x0000000006E60000-0x0000000006E6A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/1704-237-0x0000000007090000-0x0000000007126000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/1704-218-0x0000000007440000-0x0000000007ABA000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/1704-238-0x0000000007000000-0x0000000007011000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/1704-241-0x0000000007030000-0x000000000703E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/1704-242-0x0000000007040000-0x0000000007054000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1704-188-0x00000000021F0000-0x0000000002226000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/1704-189-0x0000000004D20000-0x0000000005348000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/1704-190-0x0000000004C10000-0x0000000004C32000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/1704-203-0x0000000005B20000-0x0000000005B6C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1704-201-0x00000000054E0000-0x0000000005834000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1704-202-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/1704-215-0x00000000060D0000-0x00000000060EE000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/1704-219-0x0000000006E00000-0x0000000006E1A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/1704-191-0x0000000005400000-0x0000000005466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/1704-205-0x000000006EDB0000-0x000000006EDFC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1704-244-0x0000000007080000-0x0000000007088000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/1704-243-0x0000000007150000-0x000000000716A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/2004-3793-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/2532-344-0x0000000007750000-0x0000000007761000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/2532-333-0x000000006F060000-0x000000006F0AC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2532-332-0x00000000063C0000-0x000000000640C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2532-345-0x0000000007780000-0x0000000007794000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/2532-343-0x00000000071C0000-0x0000000007263000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/2532-330-0x0000000005DA0000-0x00000000060F4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/3252-3816-0x00000249DEA40000-0x00000249DEA62000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/3580-3879-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4120-279-0x000000006EDB0000-0x000000006EDFC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4120-254-0x0000000005990000-0x0000000005CE4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4120-293-0x00000000073A0000-0x00000000073B4000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/4120-292-0x0000000007360000-0x0000000007371000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/4120-290-0x00000000070C0000-0x0000000007163000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/4268-168-0x0000000000A30000-0x0000000000EBC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/4268-679-0x0000000008AB0000-0x0000000008ABA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/4268-672-0x0000000008B90000-0x0000000009134000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/4268-247-0x0000000000A30000-0x0000000000EBC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/4268-678-0x0000000008AD0000-0x0000000008B62000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/4268-187-0x0000000007360000-0x00000000073C6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4268-167-0x0000000000A30000-0x0000000000EBC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/4268-169-0x0000000000A30000-0x0000000000EBC000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/4268-170-0x0000000007280000-0x000000000731C000-memory.dmp

                      Filesize

                      624KB

                      Download

                    • memory/4324-3812-0x0000000000CC0000-0x0000000000CFE000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4816-127-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4816-129-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4816-51-0x00000000008A0000-0x0000000000BCA000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4904-1-0x0000000076F24000-0x0000000076F26000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4904-0-0x00000000001F0000-0x000000000051A000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4904-2-0x00000000001F1000-0x0000000000259000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/4904-3-0x00000000001F0000-0x000000000051A000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4904-4-0x00000000001F0000-0x000000000051A000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/4904-18-0x00000000001F1000-0x0000000000259000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/4904-17-0x00000000001F0000-0x000000000051A000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/5100-306-0x0000000006D50000-0x0000000006D9C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/5100-318-0x0000000007D30000-0x0000000007D41000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/5100-304-0x0000000006380000-0x00000000066D4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/5100-317-0x0000000007A80000-0x0000000007B23000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/5100-319-0x0000000007D70000-0x0000000007D84000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/5100-307-0x000000006EF10000-0x000000006EF5C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/5960-759-0x0000000000400000-0x0000000000C67000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/5960-773-0x0000000010000000-0x000000001001C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/5960-784-0x0000000000400000-0x0000000000C67000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/5960-785-0x0000000000400000-0x0000000000C67000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/5960-1280-0x0000000000400000-0x0000000000C67000-memory.dmp

                      Filesize

                      8.4MB

                      Download

                    • memory/5960-3651-0x0000000000400000-0x0000000000C67000-memory.dmp

                      Filesize

                      8.4MB

                      Download