Overview

overview

10

Static

static

3

965879e4e4...ea.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 15:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    965879e4e43e11ce73165f4a7d8f7d14fdd11d24d128db9ab4ea6f171c1ebaea.exe

  • Size

    6.9MB

  • MD5

    62aa29608f991148f87476a8407c56ba

  • SHA1

    fc71071da29732ef67cccabbeb0a3b384a0d692f

  • SHA256

    965879e4e43e11ce73165f4a7d8f7d14fdd11d24d128db9ab4ea6f171c1ebaea

  • SHA512

    475f3bb382200cc00727f3dee5b0c4c7f7ebeb783437924524dd1c85fb181dc9411178c476110a32904860685b958b3ac37c39f972bc3378bf091abe4268a4b5

  • SSDEEP

    196608:QsvQMJEoKJ/E25+j8658AhzVQkoImjkqDkR/H:QsQMNKJwj86/hzVQkoIekQuf

Score
10/10
amadeygcleanerlummastealcxworm9c9aa5stokdiscoveryevasionexecutionloaderpersistencepyinstallerratstealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

xworm

Version

5.0

C2

45.200.148.155:5050

Mutex

i5ZVKLKJz2PVTovK

Attributes
  • Install_directory

    %AppData%

  • install_file

    SecurityHealthSystray.exe

aes.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\965879e4e43e11ce73165f4a7d8f7d14fdd11d24d128db9ab4ea6f171c1ebaea.exe
    "C:\Users\Admin\AppData\Local\Temp\965879e4e43e11ce73165f4a7d8f7d14fdd11d24d128db9ab4ea6f171c1ebaea.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q5K22.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q5K22.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\E4y30.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\E4y30.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y47o0.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y47o0.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1140
            • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
              "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4368
              • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
                "C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3624
            • C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe
              "C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2248
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2052
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9Qk4n8B.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2952
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2004
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4296
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5316
            • C:\Users\Admin\AppData\Local\Temp\1013459001\671b3184e0.exe
              "C:\Users\Admin\AppData\Local\Temp\1013459001\671b3184e0.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2072
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 1588
                7⤵
                • Program crash
                PID:1464
            • C:\Users\Admin\AppData\Local\Temp\1013460001\9ead9c3336.exe
              "C:\Users\Admin\AppData\Local\Temp\1013460001\9ead9c3336.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4900
            • C:\Users\Admin\AppData\Local\Temp\1013461001\58aee228a0.exe
              "C:\Users\Admin\AppData\Local\Temp\1013461001\58aee228a0.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:836
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1084
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3108
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2068
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5108
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2008
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:1708
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:2124
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {023d03fc-48a9-4ec6-9078-c38d2a98f3ed} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" gpu
                      9⤵
                        PID:5000
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2492 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {685e46e9-d3b6-45fd-b6d8-29b36791427f} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" socket
                        9⤵
                          PID:3584
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2864 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3436 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07397826-9540-408f-af2c-cfd0900c3b98} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" tab
                          9⤵
                            PID:452
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 2 -isForBrowser -prefsHandle 4088 -prefMapHandle 4080 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc3cb307-8de2-49aa-a252-4b47378e9994} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" tab
                            9⤵
                              PID:2616
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3976 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4744 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89339609-a970-4dd2-9093-4bc79a99e3b5} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" utility
                              9⤵
                              • Checks processor information in registry
                              PID:4188
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 3 -isForBrowser -prefsHandle 5580 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ddf4bb3-4258-452b-8395-74a9c4aa3653} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" tab
                              9⤵
                                PID:5344
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -childID 4 -isForBrowser -prefsHandle 5736 -prefMapHandle 5740 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcbfe945-be1e-45e4-8474-35ebc01c4d01} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" tab
                                9⤵
                                  PID:5360
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4908 -childID 5 -isForBrowser -prefsHandle 5964 -prefMapHandle 5968 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c8c8b1a-5dc7-4805-80dc-0e7e08df92d2} 2124 "\\.\pipe\gecko-crash-server-pipe.2124" tab
                                  9⤵
                                    PID:5468
                            • C:\Users\Admin\AppData\Local\Temp\1013462001\084b270fb4.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013462001\084b270fb4.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1892
                            • C:\Users\Admin\AppData\Local\Temp\1013463001\5709903910.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013463001\5709903910.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5708
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 784
                                7⤵
                                • Program crash
                                PID:7052
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2A1505.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2A1505.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1632
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1560
                            5⤵
                            • Program crash
                            PID:4272
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3J09a.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3J09a.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3348
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4C322a.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4C322a.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4476
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1632 -ip 1632
                    1⤵
                      PID:3136
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:764
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2072 -ip 2072
                      1⤵
                        PID:512
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5708 -ip 5708
                        1⤵
                          PID:6940
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6832
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5252

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Discovery

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                          Filesize

                          2KB

                          MD5

                          968cb9309758126772781b83adb8a28f

                          SHA1

                          8da30e71accf186b2ba11da1797cf67f8f78b47c

                          SHA256

                          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                          SHA512

                          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          18KB

                          MD5

                          ab0771230265d88194d037981a418442

                          SHA1

                          406b4f6641a11e46acd3fb4f5111c05710e2c150

                          SHA256

                          891451833ca3b6a372ebcb2847b15a541918e8c9560fdefa717ade6fabb05650

                          SHA512

                          ef5c131a7bc30c96bdd883fc03473dde2b57cacb8eb99a6c41b1bbb8afad1ec2462c086da1c49fa84d74e3189835b937159ec672504ba35236f08177f7eebd73

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          18KB

                          MD5

                          d19e3c7240105d142520340becd7dc0e

                          SHA1

                          fc8fc49cf8820839bfbeccf8796293363077370c

                          SHA256

                          a7aa5b0db62ba7a29e8610002c406200dd1265a556b4eb6cb234fc2208439320

                          SHA512

                          717464121c8c9d211a2c26aafefbea69c56ea94a5163cfe83c1858159669313291272ea09c029bd0a2a8a21e848b05fc525e498272268e147a20adcc97c5dee4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          18KB

                          MD5

                          a430f16fb60f39828480a8972778a2a5

                          SHA1

                          552e1f9ade6dcc55c343d48814756258e61db47a

                          SHA256

                          504cd26ff9de2ad0a02a2449cfda9711e5664fbe7f1fb0fa609b2092e314806b

                          SHA512

                          743b91f9c447304bebe9cfeb25197fcf49adeb6e7606a1d95cfdc35100f85fc3600f3d6f52d5606247a5eff5cb9e0d870020945413eb6ff91f7af09289bffcc4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json
                          Filesize

                          19KB

                          MD5

                          2d1c493c3aea350125a04bafd2c2793a

                          SHA1

                          ca79a5eba565ba9787b5da4b65d54d80849dcb4a

                          SHA256

                          aab78b6ba00f0907bef52ef2586c08172deeb44fb963dca6b390a4f059ca2794

                          SHA512

                          c57abfc6e6eac5611602f7444806e35391ed12bca2e7cbcbc713103d7289a51eb571c59b090d9913a10a8172333ddd9e10ce799019c76382ed16de8af50c2b27

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          c2b3bb0052ccdb89da1187b7be56a8d2

                          SHA1

                          5e3f1e0311de7b76c799995150a79910b741076d

                          SHA256

                          79b22b9bcba4d7f4fc4b301b4d9102f55d9b4513608d93f72583bdb266db714c

                          SHA512

                          bb7394e5415eda69b709106161a8b1395875f309ed6b8e1ed604c7f0072d53d58faae5fe112f157e74b94bac886344e76b1d9c6ad547a893ab9ecc91cd785340

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe
                          Filesize

                          9.9MB

                          MD5

                          53306653e88891da35bdfc1330a2dafd

                          SHA1

                          0870df54ca24e32bf88ccf00d7dd0ada3a0ea096

                          SHA256

                          fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09

                          SHA512

                          930ff27fc7377eaf0097cc6430f2c5486336c398a7ae08fadbcb0af62490b96c0b9ec3d36455c04e5a79d2405fc0c6f1f6a44b0298f3b6ff46f2a6c591aa51ba

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013458001\9Qk4n8B.exe
                          Filesize

                          1.9MB

                          MD5

                          5d88053a8fa89daf50a22f3e7130b84f

                          SHA1

                          376315c3b18c6d410a615dcc18dff4529f44ef9b

                          SHA256

                          78d2025e6bfce4ee78142552e30d2eb07c9bb7901ec6407ab8ce5bba72c13074

                          SHA512

                          f60af0d664d5a13555c21891a02fab76d7c63d45b6497e8c7da1cad3cc89223d1578c9b0a394fd23bb650777eb8f295cb372519db0c22a7061c0a4a0872261eb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013459001\671b3184e0.exe
                          Filesize

                          1.8MB

                          MD5

                          fc730cc04cea274ba94c95faad570950

                          SHA1

                          9959c1e33b3fe4f3e4da5e033f97a39004518b7d

                          SHA256

                          478b4646887cf4961943568f8aef881f2991e0fffaf5d2592939724c6a8c2d78

                          SHA512

                          5eb3af384e548e3ae02a1a0b972394b6a4b40798df44e379d50dd251c1f61eccc0d90460f966de2c3868ed9b521daae7e59c1eef449b02e884ffb96b408a7281

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013460001\9ead9c3336.exe
                          Filesize

                          1.7MB

                          MD5

                          be752df2a3bae5d9fbd14d433b351967

                          SHA1

                          64355c823c38b257e469ff717c5ba8a9e0b0bbf2

                          SHA256

                          08570ded4cf2c4a1d44b1837436d241c0392f3c9f35ff96da78ffc80dcdcf0fc

                          SHA512

                          600cb7a8e7832f70909f53ea387c850d8a8b7e255d80f7049ff4833b198ae18cb817460e2343ff92021935c17d4845caa88ecf4ecbad8b832083d6f0fd83b151

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013461001\58aee228a0.exe
                          Filesize

                          948KB

                          MD5

                          20f205ebc3ddeec636e52a437b8c3c9b

                          SHA1

                          a7d0319411c2b8d115b5fb02f1ef63a37c7ea55f

                          SHA256

                          d1f20d134a92d23683fc218749a27d327a9ac6a35cdcde8bded0854bc05ab3e8

                          SHA512

                          2a7880884aabb5a5cd1677455c38f50d6e97d7ffe11688673f683c76031725fe068acfc0f530bd3d1d574d721566ef9308431595b09cff17840a294b5b19afcb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013462001\084b270fb4.exe
                          Filesize

                          2.7MB

                          MD5

                          43c842910f45deae72a62e0819adceb0

                          SHA1

                          fffcc762a5d4753855e62bd845ad39e43c962097

                          SHA256

                          aedb1af233367d2b3facb397055713f112e2fd833e625f07fff1ae723ebc4fb8

                          SHA512

                          c9fca70038e11e562e613d13061e2b68c378ee16bddf7341ca81e3502e07f31d01431f8acb39d35d43444115d96a0ace52d81d352ccbddbbe66773f64cc73fc0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013463001\5709903910.exe
                          Filesize

                          1.9MB

                          MD5

                          e96cd9e1c8cbc927c9c445e155d5bd75

                          SHA1

                          6c8d7a80cb4635fda0f7b799ace942dcd10b3700

                          SHA256

                          9f1169888c4c2acd65e79928bb27a686204fa3b622b921a7ee56c7a735924eb6

                          SHA512

                          419cb0650a718f7356335745a64d441d8693c48181692bdfb22da508fa993e93772f5ee89ae5085e5ae3d04f28936b57e12e6704291be6acc45041744ba7f413

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4C322a.exe
                          Filesize

                          2.7MB

                          MD5

                          0c628411b34cd221d309d406683deca1

                          SHA1

                          5f8be3da5456806706c322c3c83aaa60c2d5f1f3

                          SHA256

                          0332638fac22e2222292b66defa0c78ac428d160e44802ca89cfe0b898f70620

                          SHA512

                          40c2c39c84d56d4cd3a0541fefb04738eab0e19e9aef3baa0f9ffff89b264cddd33fa056f9a23dfdf92c6dddb5dc6334dcead943d634143bbd0d2601b3332fb9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Q5K22.exe
                          Filesize

                          5.3MB

                          MD5

                          771018447f1f4087e153bfaad41a1a1f

                          SHA1

                          9de7577a9da52b20ad249935bf165266550ac455

                          SHA256

                          3eb59a068ef166d761b0866ee3525d34cffd36c2157d89b2d6972857d06922be

                          SHA512

                          4dfc6f9753bc30b173ead0f27faaa3ebc8bc7c8afb2cdee3161ab11d013e76dee728aee3a88f68c0b772cfab9596339d13565067989b38590a5dea8dd83f890f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3J09a.exe
                          Filesize

                          1.7MB

                          MD5

                          a7af58fe0da7ef19da6ad1ce8376597e

                          SHA1

                          891eb45d3c52f186cd2cfb03997b996c4535bf26

                          SHA256

                          b8b2986f268c6ba53ea30d750092c0a26e7fe8cdfb74a3ff3be9513ad05b716d

                          SHA512

                          7c0d7d30b7c6a013378ab2f744d45b218c5be00fc20bfc00cd983a13e60645e8dc311278c433d842151043408fb316a00c20cb655b13426dcd7e6acfdcbb25c5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\E4y30.exe
                          Filesize

                          3.5MB

                          MD5

                          a98aae66f797a0ab6774f3c23e6eac71

                          SHA1

                          27eeb33c9679bad97af116c1503ad6dd3d2988d7

                          SHA256

                          85bbff66091500863bf48b7c63f188812dd4ff780313ca93a95ba06f819679f2

                          SHA512

                          0cb98a81ce322623bc83388f2aeebb39ce04f5b14336d0fe184f81b858e3b0acda1aaa12fa5aca8d1daca1cf59d0780c0667c18a94938dcef9c4e8cdf26fa888

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Y47o0.exe
                          Filesize

                          3.1MB

                          MD5

                          03bb6c45bf7f0ce8caa6c8ba6ca33509

                          SHA1

                          f59d3d9d070984d3bd3e4bd7c903990b204ed554

                          SHA256

                          7f9c4f99669b5c05535075cc97e746e9df229b8177f56a0a9e989b861e8a2ef4

                          SHA512

                          0e99313226eb3df882a9372820532d71ebe95616f7290e4eb08256681af7bf8826c66cea34cd50f89b1dc34af145fa7803d036d64d58a45855e998982d4259be

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2A1505.exe
                          Filesize

                          1.7MB

                          MD5

                          2e294f3db1a3b1f0624b69d47ba3456c

                          SHA1

                          082c1d3d3a7363b86db51d01e23959f72eaf740c

                          SHA256

                          03100a9686a78171ad87a164d17b5cf4defc92736db32352fc16bf60e5d731fc

                          SHA512

                          c60875c1825ec998996de35c52cff8b03c0b98631578c93bce026c9f580494fd2df216bbbe6db13832b67a4f0f21d045926041ce3865f87508c5bdd422e753e7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\VCRUNTIME140.dll
                          Filesize

                          94KB

                          MD5

                          a87575e7cf8967e481241f13940ee4f7

                          SHA1

                          879098b8a353a39e16c79e6479195d43ce98629e

                          SHA256

                          ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                          SHA512

                          e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\_bz2.pyd
                          Filesize

                          78KB

                          MD5

                          bcf0d58a4c415072dae95db0c5cc7db3

                          SHA1

                          8ce298b7729c3771391a0decd82ab4ae8028c057

                          SHA256

                          d7faf016ef85fdbb6636f74fc17afc245530b1676ec56fc2cc756fe41cd7bf5a

                          SHA512

                          c54d76e50f49249c4e80fc6ce03a5fdec0a79d2ff0880c2fc57d43227a1388869e8f7c3f133ef8760441964da0bf3fc23ef8d3c3e72ce1659d40e8912cb3e9bc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\_ctypes.pyd
                          Filesize

                          116KB

                          MD5

                          41a9708af86ae3ebc358e182f67b0fb2

                          SHA1

                          accab901e2746f7da03fab8301f81a737b6cc180

                          SHA256

                          0bd4ed11f2fb097f235b62eb26a00c0cb16815bbf90ab29f191af823a9fed8cf

                          SHA512

                          835f9aa33fdfbb096c31f8ac9a50db9fac35918fc78bce03dae55ea917f738a41f01aee4234a5a91ffa5bdbbd8e529399205592eb0cae3224552c35c098b7843

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\_lzma.pyd
                          Filesize

                          150KB

                          MD5

                          ba3797d77b4b1f3b089a73c39277b343

                          SHA1

                          364a052731cfe40994c6fef4c51519f7546cd0b1

                          SHA256

                          f904b02720b6498634fc045e3cc2a21c04505c6be81626fe99bdb7c12cc26dc6

                          SHA512

                          5688ae25405ae8c5491898c678402c7a62ec966a8ec77891d9fd397805a5cfcf02d7ae8e2aa27377d65e6ce05b34a7ffdedf3942a091741af0d5bce41628bf7d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\_socket.pyd
                          Filesize

                          73KB

                          MD5

                          79c2ff05157ef4ba0a940d1c427c404e

                          SHA1

                          17da75d598deaa480cdd43e282398e860763297b

                          SHA256

                          f3e0e2f3e70ab142e7ce1a4d551c5623a3317fb398d359e3bd8e26d21847f707

                          SHA512

                          f91fc9c65818e74ddc08bbe1ccea49f5f60d6979bc27e1cdb2ef40c2c8a957bd3be7aea5036394abab52d51895290d245fd5c9f84cc3cc554597ae6f85c149e1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\base_library.zip
                          Filesize

                          812KB

                          MD5

                          ab6d3149a35e6baddf630cdcefe0dab5

                          SHA1

                          44cdb197e8e549a503f6cfcb867a83bf2214d01c

                          SHA256

                          1d91fa604893531393f83e03e68eb97d2c14c2d957ed33877d2b27b7c30ce059

                          SHA512

                          28a882e86d92d42ff983b68445cc90431c2b65b7ec3abbffb5585a9750d67b8b52a1361e20d4d80ca4a30b927fe543a2e9c9a65c1846e42a112b511ddc59545a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\libffi-7.dll
                          Filesize

                          32KB

                          MD5

                          eef7981412be8ea459064d3090f4b3aa

                          SHA1

                          c60da4830ce27afc234b3c3014c583f7f0a5a925

                          SHA256

                          f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                          SHA512

                          dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\pyexpat.pyd
                          Filesize

                          187KB

                          MD5

                          f3630fa0ca9cb85bfc865d00ef71f0aa

                          SHA1

                          f176fdb823417abeb54daed210cf0ba3b6e02769

                          SHA256

                          ac1dfb6cdeeadbc386dbd1afdda4d25ba5b9b43a47c97302830d95e2a7f2d056

                          SHA512

                          b8472a69000108d462940f4d2b5a611e00d630df1f8d6041be4f7b05a9fd9f8e8aa5de5fe880323569ac1b6857a09b7b9d27b3268d2a83a81007d94a8b8da0ff

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\python310.dll
                          Filesize

                          4.2MB

                          MD5

                          c6c37b848273e2509a7b25abe8bf2410

                          SHA1

                          b27cfbd31336da1e9b1f90e8f649a27154411d03

                          SHA256

                          b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8

                          SHA512

                          222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\_MEI43682\select.pyd
                          Filesize

                          25KB

                          MD5

                          431464c4813ed60fbf15a8bf77b0e0ce

                          SHA1

                          9825f6a8898e38c7a7ddc6f0d4b017449fb54794

                          SHA256

                          1f56df23a36132f1e5be4484582c73081516bee67c25ef79beee01180c04c7f0

                          SHA512

                          53175384699a7bb3b93467065992753b73d8f3a09e95e301a1a0386c6a1224fa9ed8fa42c99c1ffbcfa6377b6129e3db96e23750e7f23b4130af77d14ac504a0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ucw45f3.1ds.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          10KB

                          MD5

                          9952c9ecb1cf993f55a0c94d01e24945

                          SHA1

                          9e08fde3171e4625ddfd3d4a038faf389bb589f6

                          SHA256

                          fb48fe7424241c631119a6fa0d70905e8d3ee8a405b6456c3845b536341ac104

                          SHA512

                          a2c2bfc4429eb434d6a3c092bd7a88b23c82b6d0d90098c4645238e86d60b7e26a2cededb4db8d35d876489f344da90c16cef785786a4f98afb9d61bab28be94

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          6KB

                          MD5

                          d53474e6d3ea36628859a9a319ac714b

                          SHA1

                          6bdfa8a03fc4ea49d542dda2253d7134d6aba149

                          SHA256

                          0b31cdb542764bbe0d6475f9e5817d36654bd6e14f5332ffedd4c32f59808c52

                          SHA512

                          7df15a9a01d0111021a314486d82f0b90e7bbf2ffb4133837f82a47ea3e59f2bcc1098f08505debe924cb402413fbf95874b6ed299e883c8fcda73b575c70d30

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                          Filesize

                          18KB

                          MD5

                          13adddcd35fe035525d32303272305b6

                          SHA1

                          8ed4531ccc25c83ccf37564f4d688dfc812e81b0

                          SHA256

                          79020315d9f4ec4081b1fbe5f5cda042603558f57d80b4ffaa38d0b5a4a95867

                          SHA512

                          57d71f5ab3fd737e7bc90b3459539214e07cb97dde6127c79d1d07bcc89b223b093caa275eae651377783ff543ed9d4e3df28eb60a04a1c426f80e050cd95a47

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          23KB

                          MD5

                          ff3a3ac28cfd0f8516491b79b3e069ff

                          SHA1

                          9a4f384d5dcbcb388735999a0f4965a59327241b

                          SHA256

                          b13097350e590c6fc504e0f37019280ccf73147c4dca638069d675d718bd8cbd

                          SHA512

                          be4160d9076a9036acd2ea7ac7759ab4707e5df94e0423aa59297a344ca61dac85b8b04b331e79365de6842c4c2febce81a5a4fe7e277c878078d58bc3a38dd0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          6KB

                          MD5

                          c52666b5f81149009ba8fa32fa380b8c

                          SHA1

                          0986418507940af09b024f0480e8be35d54e46f4

                          SHA256

                          7d4d76d44f81aa82244a3d1cfe5895964c3f66c99463d0cc9a99532d703bdd27

                          SHA512

                          bcbacd801bf2f1e825d3cf8015b1510647f015d7b02b4098307ec2f938a02b37b40e02c57e95e844a26df1ef86fd2dfa5393920907ea90d4f96cbc785a0d53bc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          53a6991519c875f35f2cb5bafb03a67b

                          SHA1

                          69c1bfede71b5ffca97d0153f21b4721f1f959ee

                          SHA256

                          2ebc88b8ecb41ec78748cdcbc95d34ec733774239a8fae0a1ff70e7bc069141d

                          SHA512

                          19fa40c078d39b614a5051ca7e26e400603d201ed3c0e7e318259d6222898da86e0e50c2c98883ccee89375557d7f34beb4562f63f880b0725488071819808f9

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          63c0f11c755e8af8a042b4e7dad19f3e

                          SHA1

                          4344092a0b356f99e11388d3ab7edabf22e95c36

                          SHA256

                          85a4ef638883b932825bcb5d857abfb8de12d922ba6f99cd422cb50d95c3c06c

                          SHA512

                          21491fcbd2900271bc567cb0b77c453e0aeb5acb56157f92432a2a0e11fec6518b2008abfe648c0d448050b06e6239d2eb13d0cf2599d28ae152483a577e10a1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          15KB

                          MD5

                          92b4a9b74700988c22a53989c60d8b1e

                          SHA1

                          5b6cd7c29529d250ac8a1b157507f3c16b7fd029

                          SHA256

                          d07831bf5f567b67253e055cac9b747b32eab51bcc3ad6364c2e5f2f0e3c1552

                          SHA512

                          29d8f3d928465eee7f51944642a2c83a35876fa6b2bdb473b0d2fa6d8667f3a088807e47dd777d70d5f047150ecba97b21e88066b83ed617f620b82ab101c614

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          3c7ce6b877df62fe1e3d03aba30333f8

                          SHA1

                          c08a2adcac7042e7ec597f2461b7c4311624e433

                          SHA256

                          0bd756701f800e4f5449bb7dda67ab4b663a09c470fe1ba74a1c0fd072408154

                          SHA512

                          f0013d7fc84273e574bf872b448bf8b5e4d4f1dd5e50f2d28363729c660f62e3fa574cd9cc87bfe9e3f6a37d3462607732e52d818b8d2eb127cc292efeb7f31f

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          1ff33a094fc9c7a06df53057f54b76b6

                          SHA1

                          c28d4b79e53b9f05b59ad75995777c89ee9f4728

                          SHA256

                          f5f56272f4b8ef00012b0d1a146e10b770e99ac2ddb51be094b5ada5b12c4e1e

                          SHA512

                          9a4c32c3ff0b6b53edb43feb990fff08206e9cee3a391f245f432a5d201f60d6c12bd1b0b83d390941ca2f0c5c1a1783d023cc8d32e391fbdc6b3969e5cdd802

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          9b06d283cf78bf236d06d19f54c878ff

                          SHA1

                          72ad077c9880522e34827d5745a9ed317a8d21c6

                          SHA256

                          0e49356fa74a0c102b80ff9c45266de2f0038a7f6df6012d4f03f3d94bc41fa8

                          SHA512

                          0dcc8b18165320336f0f4549fed33cc91090dc07e56d948d5151870fe27a68578332267acf444f36387d83400a9e83a588879e189ddce48a177a28342fc2e9f1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          a9c9aece80110ed1c70ef0b244003c7b

                          SHA1

                          78cfc66163c0e23a32f75726cddbe9b237100248

                          SHA256

                          30af127651e88fd7428bae59e095bb13dbf31680d2ce3345b0da7597d8e1b902

                          SHA512

                          f9293edf632067dbd305075ce5f246dde548384344382c1cde894e31b436a4bb407c2d66edd40c9e0830af89086a1f3fb54188d5af790cb30930b72fc8491d45

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          6KB

                          MD5

                          26c070f31b0d1561630a3e8aaa28de94

                          SHA1

                          c7af3b276235cf5dae8aa40f158b6a4cffcbba90

                          SHA256

                          1d5c24565fa81d46e3b07b087848e39f8b9e83617c08d5f7ffd08771011ac5b5

                          SHA512

                          57a2dbf6bbafd2afec84d2041ded3b38fcf6f0b051afb8f003f4480da9bd56fb3c55476455e435c04cc3e428284f16441986257aa0df0bbbd6f037de1c6df77a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          70f5340fae9b53f80807d99b42765bb9

                          SHA1

                          6a8aadd6cdc3013987e977cd09898b6537c8df77

                          SHA256

                          07a01aeeb81eaf568398d5f1f4d1a999c9ac37356e495ab47bf77b381f6b8782

                          SHA512

                          25fe6e682e317ac60f933110f5148611f28f96a068196fded9794bcc1eeb27b430c78f8994dba344dff1a4e4d532823eed5a4b9b55ac391852bc19d30dfcb439

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\25ff1e58-56e3-406a-977a-f578e3f0f626
                          Filesize

                          28KB

                          MD5

                          83cae93f3f7bae436892887c3768f3a2

                          SHA1

                          95dc6c381839df827603670aa76b29656da22bec

                          SHA256

                          7add19279f41e5a786e11daff618174a0e52cc9ec84a25ef3dc2c7e5dd5da208

                          SHA512

                          5ebb542956c62f39040097d67b129698cf9726c6aeb9a0d0da0c9cd26fc461b9a9ec6fc24e77f579f223e7e9db5cc8e331394002c0eeea6c611a3b4ee1fe974a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\2afbb349-721a-47c3-acc2-8f1f1dfe0138
                          Filesize

                          671B

                          MD5

                          e86d68da98b73fad0259c1c13e8ffc9e

                          SHA1

                          76673c7dbaf5591db8637a575fb29d62db4584ba

                          SHA256

                          2af040cf263b58d98767d4f2ef74d4c1cd9fa7a0f6ae9cf024b961e433e8add3

                          SHA512

                          a3f8e7237bca144db5291710a2dad2a26e8808e8ec36622f1ac9d5ad71a0e238ce306fd273eec59709357c0ee72f6c82126e96b53e11796492eea3fc6070e156

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\39136c84-04ec-4d1f-8e9b-530c636c3d10
                          Filesize

                          982B

                          MD5

                          0a230079adab8081f2cbf5b2061fe12e

                          SHA1

                          17135f8e485761c45519276a93427ccf1a991e97

                          SHA256

                          db8b1f31be6a90f1de7fae1e320a633b0cfb0153ad562c87efdecc4b1471ce2c

                          SHA512

                          ab4a6c735a83dcc6aafe05e748606e26bc4aaac845d5e96ab971fcee7e415b875f6facd1c6980e36d42e1e0fa3b91436d55510b58b3e365d7277ac6a03f70cb9

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          10KB

                          MD5

                          7a9bd7c8bd18e40a30253376d662a2c7

                          SHA1

                          a0477131b1d4480fe4fe5d6a3a90c8e52d9aece2

                          SHA256

                          4ab86653e41ca7b08080a5cf265127157c23b0c92d5c39228b253b39ba24c113

                          SHA512

                          923909711a4fa19e929f808796a05bf3c2b619e122c6db0938df256cbba410eb5658f4364749d2e217c89136e7b37f89a959d128feb5aa08cf5c41e39c1c0c05

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          12KB

                          MD5

                          5cecf427c3654a4fe1af0e892f8cb2ba

                          SHA1

                          06cfd8f5912fdfc6e2e2c847bd781b28e480abd9

                          SHA256

                          8a78dad0c91be03ee88b3f1dee54b8829842102bd664416ab915fc9a99a8f95d

                          SHA512

                          e7c0245448df4a0691c78658be70f71cb1ed1c08e578287b5d8d7580b46379892d30a54976a82dc6a91b5b440b43c31afaa21de3a2cbcb08ca5dffcef9257cb9

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                          Filesize

                          15KB

                          MD5

                          c02d562e9c7c6def2b83b9506bcb9a82

                          SHA1

                          9cf97d8a90718117f32c16b93ac4a22aba4bacf4

                          SHA256

                          36eb3c04678181a044f6dc1ee1624f9e617c288675bda9dc677eb1cb40c42eb8

                          SHA512

                          68f821dca2658cfd9a02daaff7ad3ee73c1a4212caffa7aaecece9e37d884ab3602d3d06fa17362a43c72cd9da803fa9d439773cd688d01211ca79f6aade95f6

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          b6851e1746e452da0a2c3b0552211b15

                          SHA1

                          f195ed898b002d50115d87bedd8ac513113e5b18

                          SHA256

                          99ce6ee84648e33889d68841d0de0097bfa54c7ac4c29db23a8b0ea7c3cd192b

                          SHA512

                          a81acfd474c7f3ad5493750bda3952c6e3bba662c27c0f6fe3319d808185dd9a5326471452989ceb85f40ee53755bad435b25ffbd465153ab0347124dca6509f

                          Download Submit

                        • memory/764-179-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/764-200-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-33-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4078-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-1204-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4393-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-340-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-1602-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-204-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4398-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-1173-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4375-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-54-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-53-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4379-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4386-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4389-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1140-4391-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1632-41-0x0000000000510000-0x0000000000990000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/1632-39-0x0000000000510000-0x0000000000990000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/1892-1191-0x0000000000980000-0x0000000000C46000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1892-396-0x0000000000980000-0x0000000000C46000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1892-406-0x0000000000980000-0x0000000000C46000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1892-405-0x0000000000980000-0x0000000000C46000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/1892-1188-0x0000000000980000-0x0000000000C46000-memory.dmp

                          Filesize

                          2.8MB

                          Download

                        • memory/2004-351-0x0000000007A20000-0x0000000007AC3000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/2004-353-0x0000000007D10000-0x0000000007D24000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/2004-352-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/2004-341-0x000000006F790000-0x000000006F7DC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2004-338-0x00000000063A0000-0x00000000066F4000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/2052-269-0x0000000007370000-0x00000000079EA000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/2052-241-0x0000000074900000-0x000000007494C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2052-277-0x0000000006F60000-0x0000000006F74000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/2052-276-0x0000000006F50000-0x0000000006F5E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2052-273-0x0000000006F20000-0x0000000006F31000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/2052-272-0x0000000006FA0000-0x0000000007036000-memory.dmp

                          Filesize

                          600KB

                          Download

                        • memory/2052-271-0x0000000006D90000-0x0000000006D9A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2052-270-0x0000000006D20000-0x0000000006D3A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/2052-279-0x0000000007040000-0x0000000007048000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2052-260-0x0000000006BF0000-0x0000000006C93000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/2052-259-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/2052-278-0x0000000007060000-0x000000000707A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/2052-240-0x0000000006BB0000-0x0000000006BE2000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/2052-239-0x0000000005A20000-0x0000000005A6C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2052-238-0x0000000005A00000-0x0000000005A1E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/2052-222-0x00000000020D0000-0x0000000002106000-memory.dmp

                          Filesize

                          216KB

                          Download

                        • memory/2052-231-0x0000000005410000-0x0000000005764000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/2052-224-0x0000000004B60000-0x0000000004B82000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/2052-225-0x00000000052C0000-0x0000000005326000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/2052-223-0x0000000004C90000-0x00000000052B8000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/2072-237-0x00000000008A0000-0x0000000000D56000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2072-219-0x00000000008A0000-0x0000000000D56000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2248-1140-0x0000000008DA0000-0x0000000008E32000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/2248-201-0x0000000000760000-0x0000000000BEC000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2248-280-0x0000000000760000-0x0000000000BEC000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2248-1139-0x0000000008E60000-0x0000000009404000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/2248-197-0x0000000000760000-0x0000000000BEC000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2248-203-0x0000000007560000-0x00000000075FC000-memory.dmp

                          Filesize

                          624KB

                          Download

                        • memory/2248-202-0x0000000000760000-0x0000000000BEC000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2248-221-0x0000000007600000-0x0000000007666000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/2248-1141-0x0000000008D80000-0x0000000008D8A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2772-35-0x0000000000C20000-0x0000000000F4A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2772-21-0x0000000000C20000-0x0000000000F4A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2952-327-0x00000000074B0000-0x00000000074C4000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/2952-326-0x0000000007450000-0x0000000007461000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/2952-325-0x00000000071A0000-0x0000000007243000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/2952-315-0x000000006F790000-0x000000006F7DC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2952-295-0x0000000005F50000-0x0000000005F9C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2952-289-0x00000000058B0000-0x0000000005C04000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/3348-46-0x0000000000600000-0x0000000000C85000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/3348-45-0x0000000000600000-0x0000000000C85000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4296-385-0x00000000071D0000-0x00000000071E1000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/4296-365-0x00000000061C0000-0x000000000620C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/4296-366-0x000000006F3A0000-0x000000006F3EC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/4296-376-0x0000000006EF0000-0x0000000006F93000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/4296-407-0x0000000007200000-0x0000000007214000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/4476-167-0x0000000000D80000-0x000000000103A000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4476-68-0x0000000000D80000-0x000000000103A000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4476-50-0x0000000000D80000-0x000000000103A000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4476-51-0x0000000000D80000-0x000000000103A000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4476-52-0x0000000000D80000-0x000000000103A000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/4900-275-0x0000000000960000-0x0000000000FEE000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/4900-268-0x0000000000960000-0x0000000000FEE000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/5252-4396-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/5708-1392-0x0000000000400000-0x0000000000C67000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/5708-3567-0x0000000000400000-0x0000000000C67000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/5708-1200-0x0000000000400000-0x0000000000C67000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/5708-1199-0x0000000000400000-0x0000000000C67000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/5708-1177-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/5708-1164-0x0000000000400000-0x0000000000C67000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/6832-4373-0x0000000000F10000-0x000000000123A000-memory.dmp

                          Filesize

                          3.2MB

                          Download