Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 17:55

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    f401f240c068bac2c47c4beb9446d2a0

  • SHA1

    2e659821c32f600fe2715814e5d96ff0eac09eb4

  • SHA256

    3ca467dad80a62f640093dcf65b29e413820c24288e3ac5dbfb4ca7639dd55d4

  • SHA512

    aa400b23501496f81ae5e695ddc2ebf261750696ca141a884f783563138c0dbded303f3d095ebb9a2b1f458ef3c1facafb15729bb5353a8500c7e932e94dd608

  • SSDEEP

    49152:DcKkpLBKiQ85dPY67Y3YwboNMxkaWNWtJ5jYh/:DcKkpLwhgdP4BMNMxkaWNWtJdY5

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Renames multiple (8134) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 22 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 43 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 10 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
        "C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Users\Admin\AppData\Local\Temp\1014844001\BlueMail.exe
        "C:\Users\Admin\AppData\Local\Temp\1014844001\BlueMail.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 612
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1712
      • C:\Users\Admin\AppData\Local\Temp\1014879001\00b94efba0.exe
        "C:\Users\Admin\AppData\Local\Temp\1014879001\00b94efba0.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014879001\00b94efba0.exe" & rd /s /q "C:\ProgramData\FCBAAIW47GVA" & exit
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:5628
      • C:\Users\Admin\AppData\Local\Temp\1014880001\9b502beb85.exe
        "C:\Users\Admin\AppData\Local\Temp\1014880001\9b502beb85.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        PID:4028
      • C:\Users\Admin\AppData\Local\Temp\1014881001\43113a0210.exe
        "C:\Users\Admin\AppData\Local\Temp\1014881001\43113a0210.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4920
      • C:\Users\Admin\AppData\Local\Temp\1014882001\735fc0de56.exe
        "C:\Users\Admin\AppData\Local\Temp\1014882001\735fc0de56.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4972
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2396
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3288
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:4828
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5052
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.0.1120961704\992631518" -parentBuildID 20221007134813 -prefsHandle 1264 -prefMapHandle 1256 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9798b69f-57bb-406f-9134-aa8c6d0e9867} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 1340 108dbe58 gpu
                6⤵
                  PID:5452
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.1.1580182857\642417612" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1520 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b6e65b-2c0c-43e2-aa92-95fc0304f129} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 1552 f5ebb58 socket
                  6⤵
                    PID:5264
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.2.1728248641\1071162819" -childID 1 -isForBrowser -prefsHandle 1812 -prefMapHandle 2152 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a709e5c-ca6e-4a54-b09f-3cbfda589b32} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 2188 1a217758 tab
                    6⤵
                      PID:4020
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.3.2040230931\1842816527" -childID 2 -isForBrowser -prefsHandle 2780 -prefMapHandle 2776 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dea2026b-0cf4-4407-8f9d-52d244031ac6} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 2792 1d953358 tab
                      6⤵
                        PID:3564
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.4.1477204521\1947847612" -childID 3 -isForBrowser -prefsHandle 1752 -prefMapHandle 3532 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2d4c69c-1ffa-4598-a3a9-24919e73efd4} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 3784 1da61058 tab
                        6⤵
                          PID:5848
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.5.494547762\1019541256" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d10c7d41-5a63-4f90-bafa-30aa89ece507} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 3932 1da61658 tab
                          6⤵
                            PID:4328
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.6.1969840631\1076749206" -childID 5 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cd1f5b5-058e-4453-983c-ea5509b9f300} 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 4100 1fcc8258 tab
                            6⤵
                              PID:1880
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM firefox.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2208
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM chrome.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5016
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM msedge.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5720
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM opera.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3412
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM brave.exe /T
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6236
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                          4⤵
                            PID:6424
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                              5⤵
                              • Checks processor information in registry
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:6480
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.0.1588579021\1663470216" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e648ca28-3860-4175-8ab3-6b0da7b2eb9e} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 1316 13cf8c58 gpu
                                6⤵
                                  PID:7268
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.1.890865600\1045612239" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21708 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f534b59b-c34a-4662-9aa1-8fb3467ba9f3} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 1476 f2dd258 socket
                                  6⤵
                                    PID:2704
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.2.244009678\530935150" -childID 1 -isForBrowser -prefsHandle 2220 -prefMapHandle 2216 -prefsLen 21746 -prefMapSize 233496 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c494303-e8bf-4bb9-89bd-cfdf70a39b0d} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 2232 196c6258 tab
                                    6⤵
                                      PID:5892
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.3.153447810\1104908444" -childID 2 -isForBrowser -prefsHandle 2712 -prefMapHandle 2708 -prefsLen 26216 -prefMapSize 233496 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef010fb6-215e-46dc-8848-17925cd0cb3f} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 2724 1c2c5558 tab
                                      6⤵
                                        PID:7688
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.4.996962515\943688808" -childID 3 -isForBrowser -prefsHandle 3792 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233496 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6e226d2-6f30-42b3-b3c4-248564b3c8ee} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 3796 21a9b458 tab
                                        6⤵
                                          PID:3784
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.5.1998277273\963734298" -childID 4 -isForBrowser -prefsHandle 3928 -prefMapHandle 3932 -prefsLen 26275 -prefMapSize 233496 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1b49e4-31df-4f1f-8c43-6b372950db11} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 3916 21ccfa58 tab
                                          6⤵
                                            PID:3952
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6480.6.1035241437\727210689" -childID 5 -isForBrowser -prefsHandle 4100 -prefMapHandle 4104 -prefsLen 26275 -prefMapSize 233496 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31088645-67db-48c8-a611-61c69e2309e4} 6480 "\\.\pipe\gecko-crash-server-pipe.6480" 4084 21ccf158 tab
                                            6⤵
                                              PID:4012
                                      • C:\Users\Admin\AppData\Local\Temp\1014883001\0a3b60119a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1014883001\0a3b60119a.exe"
                                        3⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        PID:6100
                                      • C:\Users\Admin\AppData\Local\Temp\1014884001\235f1b15ef.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1014884001\235f1b15ef.exe"
                                        3⤵
                                        • Modifies Windows Defender Real-time Protection settings
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Windows security modification
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4360
                                      • C:\Users\Admin\AppData\Local\Temp\1014885001\fceb3fbcd0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1014885001\fceb3fbcd0.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3568
                                        • C:\Windows\system32\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                          4⤵
                                          • Loads dropped DLL
                                          PID:5108
                                          • C:\Windows\system32\mode.com
                                            mode 65,10
                                            5⤵
                                              PID:6108
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2872
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_7.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6320
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_6.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6492
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_5.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6592
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_4.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6864
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_3.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:7020
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_2.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:7148
                                            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                              7z.exe e extracted/file_1.zip -oextracted
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6884
                                            • C:\Windows\system32\attrib.exe
                                              attrib +H "in.exe"
                                              5⤵
                                              • Views/modifies file attributes
                                              PID:6976
                                            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                              "in.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              PID:6992
                                              • C:\Windows\system32\attrib.exe
                                                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                6⤵
                                                • Views/modifies file attributes
                                                PID:7028
                                              • C:\Windows\system32\attrib.exe
                                                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                6⤵
                                                • Views/modifies file attributes
                                                PID:7044
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                                6⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:7060
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell ping 127.0.0.1; del in.exe
                                                6⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:7080
                                                • C:\Windows\system32\PING.EXE
                                                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                                                  7⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  • Runs ping.exe
                                                  PID:4052
                                        • C:\Users\Admin\AppData\Local\Temp\1014886001\42b1160850.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1014886001\42b1160850.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:7544
                                          • C:\Users\Admin\AppData\Local\Temp\1014886001\42b1160850.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1014886001\42b1160850.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Modifies system certificate store
                                            PID:7860
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:764
                                    • C:\Windows\system32\taskeng.exe
                                      taskeng.exe {10327B50-5AEF-4A6A-A577-8E56054C4DB4} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
                                      1⤵
                                      • Loads dropped DLL
                                      PID:5752
                                      • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:1976
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          3⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4792
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                          3⤵
                                          • Drops file in System32 directory
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4924
                                          • C:\Windows\system32\PING.EXE
                                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                                            4⤵
                                            • System Network Configuration Discovery: Internet Connection Discovery
                                            • Runs ping.exe
                                            PID:5248

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Recovery\README.TXT

                                      Filesize

                                      533B

                                      MD5

                                      81d185495b4e6430a87dfd37789bb872

                                      SHA1

                                      b5da653f81a548c74205c7ae3d19f30af1a14271

                                      SHA256

                                      838d654b9cb0360d8b3bb767db8fc1954fc41ba0a56fc34688aad9b50f5ddb40

                                      SHA512

                                      1106c9c2245cbd44effb42e4e1365eb796d3b2390b011fb97205550bf183b097c489194aa001f97f949e9d1ed1c970eea6cbb0477da47511e5bc18e88bf2dfa5

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                      Filesize

                                      1KB

                                      MD5

                                      67e486b2f148a3fca863728242b6273e

                                      SHA1

                                      452a84c183d7ea5b7c015b597e94af8eef66d44a

                                      SHA256

                                      facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                      SHA512

                                      d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                                      Filesize

                                      436B

                                      MD5

                                      971c514f84bba0785f80aa1c23edfd79

                                      SHA1

                                      732acea710a87530c6b08ecdf32a110d254a54c8

                                      SHA256

                                      f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                      SHA512

                                      43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                                      Filesize

                                      174B

                                      MD5

                                      fe623f43907589dba2f5e2623a1f506d

                                      SHA1

                                      10584085cf5bbbbf1baa846664da63ec3b85f0e8

                                      SHA256

                                      c5cfc19891a02f8c67fe41bd5646dd491295b02af8ae8883afa3dd3e41f7d898

                                      SHA512

                                      e1a9a3123d9a0d9d73ffbb77eb9b5936a07f2900927d9e240b6d6449b9c9544990229bffd6d9be38795c1bbbe72a2f002bc17232635bc13ed3dc79d022fbe775

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      4915912d7bf56307d23c8862d3302db7

                                      SHA1

                                      368a39ddb3d6814c74ab3c81ddc11b5702588a8f

                                      SHA256

                                      cc84df7706d92ca951e9d847712398e877efd1b1d54fdd9c0be2fb245e1610e7

                                      SHA512

                                      3c604170cd2e4d505212b508ae7b01b021039181675de0c343a59898ddd39fac6efa00209bb687e7e559f19eb25425ed1804b04c099e0d0e531f06297d6b6870

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                                      Filesize

                                      170B

                                      MD5

                                      1f73e42a5a518e4e61c7c2babeba7c92

                                      SHA1

                                      f4da4dd207b48f8798082bd9f9f69410abe6eee8

                                      SHA256

                                      6b51257bc83b83c829ab23519e2a3825b3ac9bd342390f97fc26162974762859

                                      SHA512

                                      168b7f4b6d14f8482239a5b0f81df46a073f97e741dfff9d1586fbe6c9db559455e3f94c1ea56fe87bdc14af2bf08eda52984b8cf360ee9ee422ee89b35a0b67

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\download[1].htm

                                      Filesize

                                      1B

                                      MD5

                                      cfcd208495d565ef66e7dff9f98764da

                                      SHA1

                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                      SHA256

                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                      SHA512

                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

                                      Filesize

                                      23KB

                                      MD5

                                      4d0aa0ec41e38488237b66d568012a3b

                                      SHA1

                                      f63eba0946507427c6868b89cd78b66e6bfa9c86

                                      SHA256

                                      8709256c67ea57e3d8593b9e738e1d1cb2948febdc69c5dcab4373ee93f3eedf

                                      SHA512

                                      afc9703407543ea0521188ca76db5bbc94f2e5973b99ed28528db0d3b7c949b7ab45f2ed578b3436de8e6d3e4fed414baae4357f846703b9b81cc0b7aa1163e6

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                      Filesize

                                      15KB

                                      MD5

                                      96c542dec016d9ec1ecc4dddfcbaac66

                                      SHA1

                                      6199f7648bb744efa58acf7b96fee85d938389e4

                                      SHA256

                                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                      SHA512

                                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                    • C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderHRC.exe

                                      Filesize

                                      39B

                                      MD5

                                      c2b1385b0ee636444a82abcfa02045b8

                                      SHA1

                                      0a00ba03a8762da0bbddb1c07b1670c3fd1f0e56

                                      SHA256

                                      12221f5ea418cc152bc1f78e46748989707271b97154a84bbe3503537e95c772

                                      SHA512

                                      b8fbc6d60ed1ceb1c25b3c5a666a94ad253be8b57d5d7bda045e618e2ec1d3883c6dbd33caa89dfe563b9f32e4f39b08c3409851777578ac2f0d6b8da07e0b8d

                                    • C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      42a8588cc82773cd223c42f8fe4be91a

                                      SHA1

                                      e2ed3cda00140ecd445f5f742729d34f2c452c8c

                                      SHA256

                                      d4521c34f489f4a6065dea15634df9bb700c84741f476bde1084d9cdfb373a7b

                                      SHA512

                                      681e4b155ce1015723469bd819618b292844aa00f7dab447d9557e244792efcef5614f753283efe9dd76ea77b838af78a3e69008c380482a4412b1cea75c535d

                                    • C:\Users\Admin\AppData\Local\Temp\1014844001\BlueMail.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      d39986c91ee9d1291e85711894112178

                                      SHA1

                                      4e7926c5a6e837d4570427d324a151f7b39be88f

                                      SHA256

                                      654a1585788a10801ec1ee583fe7cb1cb33d6d83d9a270ac03de4b3a03cb4c39

                                      SHA512

                                      8c81bd154fe8ebccb2e15b97344110efc6e464828cb373c2b5c22f85b3eace3bbe9ed7a35e3039ff0d4b1c6c56e2bd44f559cdc515c599e2bf8cb322f8b64aad

                                    • C:\Users\Admin\AppData\Local\Temp\1014879001\00b94efba0.exe

                                      Filesize

                                      384KB

                                      MD5

                                      dfd5f78a711fa92337010ecc028470b4

                                      SHA1

                                      1a389091178f2be8ce486cd860de16263f8e902e

                                      SHA256

                                      da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                                      SHA512

                                      a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                                    • C:\Users\Admin\AppData\Local\Temp\1014880001\9b502beb85.exe

                                      Filesize

                                      1.8MB

                                      MD5

                                      fe4e63699f62090a1bc0006ab3f7856c

                                      SHA1

                                      c261667ac64fc9a2ce23a2aaff464052b781c0c5

                                      SHA256

                                      c890656f9cdacb46f581181e6d80374a50c3c9bd5c82c88e8b497db40b9a8df4

                                      SHA512

                                      0368067215a986ecde5c076c6c95b43aeb1b096cd4b8a904a015c80e3ddb0c129dfac7ba4b47a2ba7bac238f233e08d989dad6a60800126f8d2d6c484dceae17

                                    • C:\Users\Admin\AppData\Local\Temp\1014881001\43113a0210.exe

                                      Filesize

                                      2.5MB

                                      MD5

                                      2a78ce9f3872f5e591d643459cabe476

                                      SHA1

                                      9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                                      SHA256

                                      21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                                      SHA512

                                      03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                                    • C:\Users\Admin\AppData\Local\Temp\1014882001\735fc0de56.exe

                                      Filesize

                                      943KB

                                      MD5

                                      d99f0062878ea8743875ac2f12feb7d6

                                      SHA1

                                      6542d80c673484256410dde989845a36332fcc36

                                      SHA256

                                      aa630a2548d2f2f3da9894ca88ffa6dad61536e9e8b4c6f2705e233d77601d11

                                      SHA512

                                      126292fa98e5338258993b2440aec4a788eb12ca6034dffdd93fb1f26e0d1b0a4870fc257b5b6847850d0813c79a8a10da97d4dd6bdad0fa04c940e26e47a1d0

                                    • C:\Users\Admin\AppData\Local\Temp\1014883001\0a3b60119a.exe

                                      Filesize

                                      1.7MB

                                      MD5

                                      106c3e2370747ef310e8952fd337895c

                                      SHA1

                                      aca138539a7db570756509b1133cc41dcb377e7d

                                      SHA256

                                      dd031a3622218fba8626c8f91f82be355957e7913c55d296d8a5665bbdac9758

                                      SHA512

                                      e2819d79d8ba23c5379129da2209be853585a75ba9737bbe3f15bfa106ade6ae2b52e87a69756d7d1d7cd2d6ff2fe2b5682a8ef87d5cc31d9b7d61624d8ec5fc

                                    • C:\Users\Admin\AppData\Local\Temp\1014884001\235f1b15ef.exe

                                      Filesize

                                      2.7MB

                                      MD5

                                      cfead48773e054892ca4ab92932c7c51

                                      SHA1

                                      44b4b44f27e3e39dbc3dfb5f97a4a50a4542fa84

                                      SHA256

                                      f839c77e75c4e0b634f5d6f0e6b4e9cce39968a705469d986e62c65cf9e1fc6f

                                      SHA512

                                      feab50774b88f29373cafaa721fb161efd32d958560c7e2d3d5007083776d63ecc5e89642c875b369aad19e469966a0a20eb883ebd6df0281909f8e4fbe923d8

                                    • C:\Users\Admin\AppData\Local\Temp\1014885001\fceb3fbcd0.exe

                                      Filesize

                                      4.2MB

                                      MD5

                                      3a425626cbd40345f5b8dddd6b2b9efa

                                      SHA1

                                      7b50e108e293e54c15dce816552356f424eea97a

                                      SHA256

                                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                      SHA512

                                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                    • C:\Users\Admin\AppData\Local\Temp\1014886001\42b1160850.exe

                                      Filesize

                                      710KB

                                      MD5

                                      28e568616a7b792cac1726deb77d9039

                                      SHA1

                                      39890a418fb391b823ed5084533e2e24dff021e1

                                      SHA256

                                      9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                                      SHA512

                                      85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                                    • C:\Users\Admin\AppData\Local\Temp\Cab47CA.tmp

                                      Filesize

                                      70KB

                                      MD5

                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                      SHA1

                                      1723be06719828dda65ad804298d0431f6aff976

                                      SHA256

                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                      SHA512

                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                    • C:\Users\Admin\AppData\Local\Temp\Tar6394.tmp

                                      Filesize

                                      181KB

                                      MD5

                                      4ea6026cf93ec6338144661bf1202cd1

                                      SHA1

                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                      SHA256

                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                      SHA512

                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

                                      Filesize

                                      1.6MB

                                      MD5

                                      72491c7b87a7c2dd350b727444f13bb4

                                      SHA1

                                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                      SHA256

                                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                      SHA512

                                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

                                      Filesize

                                      1.7MB

                                      MD5

                                      7187cc2643affab4ca29d92251c96dee

                                      SHA1

                                      ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                                      SHA256

                                      c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                                      SHA512

                                      27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

                                      Filesize

                                      1.7MB

                                      MD5

                                      b7d1e04629bec112923446fda5391731

                                      SHA1

                                      814055286f963ddaa5bf3019821cb8a565b56cb8

                                      SHA256

                                      4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                                      SHA512

                                      79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

                                      Filesize

                                      1.7MB

                                      MD5

                                      0dc4014facf82aa027904c1be1d403c1

                                      SHA1

                                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                                      SHA256

                                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                                      SHA512

                                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

                                      Filesize

                                      3.3MB

                                      MD5

                                      cea368fc334a9aec1ecff4b15612e5b0

                                      SHA1

                                      493d23f72731bb570d904014ffdacbba2334ce26

                                      SHA256

                                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                                      SHA512

                                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin

                                      Filesize

                                      3.3MB

                                      MD5

                                      045b0a3d5be6f10ddf19ae6d92dfdd70

                                      SHA1

                                      0387715b6681d7097d372cd0005b664f76c933c7

                                      SHA256

                                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                                      SHA512

                                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat

                                      Filesize

                                      440B

                                      MD5

                                      3626532127e3066df98e34c3d56a1869

                                      SHA1

                                      5fa7102f02615afde4efd4ed091744e842c63f78

                                      SHA256

                                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                      SHA512

                                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S8MCHNBQQ322B8VRME1M.temp

                                      Filesize

                                      7KB

                                      MD5

                                      0dca9555160db88bb0b0fa7e4c655331

                                      SHA1

                                      65af55493de98131bff0a17d453878ac020a252f

                                      SHA256

                                      ee2ee731a7b0ce4f9aad26e6b8d0537597fbbe3f024af73f6b731a6e6a6d7be7

                                      SHA512

                                      42c383e9263bd6ee857f92b87c8b79802a5de5528f2faeb1a4bd83857f0942331b045c3b477d771565db64b0fe4820133a16cba6ef86b0666d9b33121e0918ef

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\cookies.sqlite-wal

                                      Filesize

                                      192KB

                                      MD5

                                      a081504255607becff7c2164b201bb62

                                      SHA1

                                      2592c689de71c23f6927d1515eb9f190e17ee39d

                                      SHA256

                                      56f33c5b7ce1902ee2546ea3342673ef192c5132778f13bccce198b83f3a22aa

                                      SHA512

                                      a490bdf700bae5de0e6e6370ec70736e68de8b3a87c6e0d0fd84ba6c7865e287f9c9b4506648b98d415860f43f1eddbbd9dc04f9b9ef76ac2119f3a2bacb9787

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

                                      Filesize

                                      2KB

                                      MD5

                                      b26c21381e40108d4ebe71d8f5afb1c2

                                      SHA1

                                      678993f546ac6698c8690c3649ee2168c394766a

                                      SHA256

                                      f4804214b27b56771d2e771dcf2cc8fe17ae01f1b6553a6bea98598011037ebb

                                      SHA512

                                      f3eed984a4e2152d0d3fea5030897ffdee38acff2b670a75e8803d60469efeb8f9f9e56792dc24d0a1476836fbd00fb7a85ce3985adba8c522dbc765cc969cbb

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

                                      Filesize

                                      2KB

                                      MD5

                                      3d3a848184c82f0f6d918c6c98a1102e

                                      SHA1

                                      390c92b18aa2af75febb0821451f8af8fb60f317

                                      SHA256

                                      53b035a4a782adf9283b742667d3ae0012907768c8005847fe16d7e996463968

                                      SHA512

                                      710bd90cbc8c81fda2be5bdc846903ddecad6100a045da902f1195d2e543aab9701b983809cb087748bc81659554a04716c098c09b0d5bcd25c37c946237a131

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\0576dcf2-22ca-4d1e-8211-43fad4a5f8a4

                                      Filesize

                                      593B

                                      MD5

                                      fe816b1c759856ffbb8c697f4ac3dcc6

                                      SHA1

                                      dee26e8383c68e072289d6363c942a2c111da1da

                                      SHA256

                                      ea0b3f4f3916fde74bcf95350248d2f29495b818b72ab12e14864f2b75143ab2

                                      SHA512

                                      beecc260827b09bb865279745efa9309062b9a17f37e11374175b2a93a62f96183bd34e3be07a70d655b2ee1a2fd0fd7b4ae4f563fb5771b97f8295372a5bc9e

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\8a2b2967-cb6b-427a-8ca2-ba4acc0acd81

                                      Filesize

                                      3KB

                                      MD5

                                      14cc60c26ff61b81a9f392505c70a702

                                      SHA1

                                      3b8a0cbc6c85bd73762b074f44e5394564949fb6

                                      SHA256

                                      24c197c51ca413a629472a2fd798e9298154e3d47949c226a663b90b5b3b88b3

                                      SHA512

                                      8768de669672a36641aa3954c97b7530af18a88bbbb2af6b59e25d74585fdc0a0fe38e9c2ea7699b2bc342cbd8dc8d9054683b51a26cc766aeb3aa85cd8f19a2

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\9b3b2890-0692-4e87-a32a-3da94b36dc66

                                      Filesize

                                      656B

                                      MD5

                                      7f984446150c59728a461f17ada9fdf6

                                      SHA1

                                      60e4327f2099cb82661804de20b14804508becaa

                                      SHA256

                                      256493fdb3be0aae22853ec8b4eace0585f88c732b56f61aad10d6d33ddfe93a

                                      SHA512

                                      3a264ded9332d9f9ff93dc959db9812b2e9beb29ca6d1c8b78d3fe063ae082a3a043b9a626b259e3c629594fd58ff4f3237a8ac5b3c8a2be9fce9403191adee0

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\dc1566ae-a4a5-4d30-b6e5-16109b8d6879

                                      Filesize

                                      745B

                                      MD5

                                      21a7036e640e0007e9e369800ff5001d

                                      SHA1

                                      41306784e15cdc76483dc58e452cf00b4481c3f2

                                      SHA256

                                      fa90845a487e39e6632ee63df7a537604972fbede9eb9305d75ca5d946eb1bae

                                      SHA512

                                      14597fdb2c3f0d7a7071ec4477aa8cb6f1ef8175164844892a7c7f08640481e1237acae04c05ce75afe7bc5ac66f875a098e4c382f2734599ee7d7b2bfbc00e8

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      19e04046c5917eaf97a6889d81a4a963

                                      SHA1

                                      49a9ab13fffe774132d58e057544919cc98a25b0

                                      SHA256

                                      f2ae639cfe663f731f41f09adfc9f314c8595255b1a77c8b93c81e50b6dbb8f5

                                      SHA512

                                      db0b89bfbf72178a9efdc796b844f2b0074800897b02579521762532b15673dae19187e0fea669ab118578ba4dfd0e33fe960cd432512ababf295612a85a4597

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      200186a92c6015eba8b994194c820982

                                      SHA1

                                      a1a58ccccf3f2001592ca808829dfa39bec2c394

                                      SHA256

                                      5cb9cf12814e19ad0387cdb78de615ffe14fae122b313f92f8e2b1be4a0e0d50

                                      SHA512

                                      ca05d46117d7063d898d2bf96076f3905139ebf06fa251ce186e142754e9ca0fa6ca944bc0a9470365c49b1ba8eb5d2041fc4315c8a95fcac11244b0c7ce84b3

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

                                      Filesize

                                      6KB

                                      MD5

                                      04afed81ae068754c0aebd48a28f47e8

                                      SHA1

                                      0afc4754af8cd56ff322e4f002a3ba97324d2f00

                                      SHA256

                                      c5afaa65a8add5fdda05ed36d9eb10c193483b4a244bdd1795d272754013dbe1

                                      SHA512

                                      e8e960c474cf73eadc84d799ca8de8a82fe8e0899a17215fdb3407047834e4b940e528f9da5397c3595a60383a0c3f48dd98c90c96a52670cb68fcb5173ea2e3

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

                                      Filesize

                                      6KB

                                      MD5

                                      7ca01355a2c0f4a44ed45f2d74a29a3c

                                      SHA1

                                      1e46afea727478bd6d06afb5fd4a2b820434da67

                                      SHA256

                                      213ff02a21fa55ff4172b413037e3e94375791bf0bea343af306f4e7c283db44

                                      SHA512

                                      e17dc05323860e718ddb9874ea2dae7e8d6c270f3f4e957d630374761b90680d7f769393107f2b907585e4c48384cebedce828bd4892b7939ffcdbdb82c47879

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs.js

                                      Filesize

                                      6KB

                                      MD5

                                      a639bc6e892cb902e892681841a3c359

                                      SHA1

                                      81bda964d3822628e7adb671d14cbd52cfb1340c

                                      SHA256

                                      28a4784a9a1e055b360f1187199be8d2c82bc9bba0488805db2484631d779c21

                                      SHA512

                                      92b81e7899cd3ad58a4da3de07159281cfe16966213e0ead5e677d87146fe186a2dc11ef0b05c98a84975e06b3e6dbba1558cec1b8e192dfb44b175d273a8c60

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionCheckpoints.json.tmp

                                      Filesize

                                      90B

                                      MD5

                                      c4ab2ee59ca41b6d6a6ea911f35bdc00

                                      SHA1

                                      5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                      SHA256

                                      00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                      SHA512

                                      71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionCheckpoints.json.tmp

                                      Filesize

                                      53B

                                      MD5

                                      ea8b62857dfdbd3d0be7d7e4a954ec9a

                                      SHA1

                                      b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

                                      SHA256

                                      792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

                                      SHA512

                                      076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

                                      Filesize

                                      4KB

                                      MD5

                                      07c6bd443bf2768bfb919152f06628ee

                                      SHA1

                                      c7245435f7b78d82da61e69b039a8e3c0c3081ae

                                      SHA256

                                      9248926795e64f6a7901bb088c2d396d178859465a37d15a00811361d86420fc

                                      SHA512

                                      560e9f34b8998575d19c237497cf215da3afd0f6e2ded511eb9a441103c8acde4b0b18bfdaebcd93e51fed1dedb61dcb5b0335cba23a430a93b356a3062983d6

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

                                      Filesize

                                      1KB

                                      MD5

                                      44895910dc7b07ca9be5682300271ea7

                                      SHA1

                                      3125923dc8d1d74b4c1b5c98c70b87dccc94b284

                                      SHA256

                                      026ebadc64bb10cbb13e4565c92bfb18a35078b35cab106094be0122a865248b

                                      SHA512

                                      53e19ed78c4d5195ae2946ad6b6261fd5ff17d1b4bf8c5279ee9f99c3c2643bc24cf74508fa5a5114f3799d161baa646c412ea7cdc9798c0b8623a6f25a55592

                                    • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                      Filesize

                                      3.1MB

                                      MD5

                                      f401f240c068bac2c47c4beb9446d2a0

                                      SHA1

                                      2e659821c32f600fe2715814e5d96ff0eac09eb4

                                      SHA256

                                      3ca467dad80a62f640093dcf65b29e413820c24288e3ac5dbfb4ca7639dd55d4

                                      SHA512

                                      aa400b23501496f81ae5e695ddc2ebf261750696ca141a884f783563138c0dbded303f3d095ebb9a2b1f458ef3c1facafb15729bb5353a8500c7e932e94dd608

                                    • \Users\Admin\AppData\Local\Temp\main\7z.exe

                                      Filesize

                                      458KB

                                      MD5

                                      619f7135621b50fd1900ff24aade1524

                                      SHA1

                                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                      SHA256

                                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                      SHA512

                                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                    • memory/1976-19214-0x000000013FD80000-0x0000000140210000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/1976-19225-0x000000013FD80000-0x0000000140210000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/2516-1-0x0000000076F30000-0x0000000076F32000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/2516-0-0x0000000000FE0000-0x0000000001307000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2516-18-0x0000000000FE1000-0x0000000001049000-memory.dmp

                                      Filesize

                                      416KB

                                    • memory/2516-15-0x0000000000FE0000-0x0000000001307000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2516-14-0x0000000006D60000-0x0000000007087000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2516-5-0x0000000000FE0000-0x0000000001307000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2516-3-0x0000000000FE0000-0x0000000001307000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2516-2-0x0000000000FE1000-0x0000000001049000-memory.dmp

                                      Filesize

                                      416KB

                                    • memory/2520-1889-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1857-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1869-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1866-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1861-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-3727-0x0000000001220000-0x00000000012AA000-memory.dmp

                                      Filesize

                                      552KB

                                    • memory/2520-3728-0x0000000000AE0000-0x0000000000B2C000-memory.dmp

                                      Filesize

                                      304KB

                                    • memory/2520-220-0x00000000013C0000-0x00000000014E6000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1601-0x00000000048F0000-0x0000000004A08000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1841-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1842-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1844-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1847-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1854-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1852-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1864-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1900-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1914-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1872-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1862-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1878-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1916-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1912-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1910-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1908-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1906-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1904-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1902-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1897-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-18717-0x0000000000B70000-0x0000000000BC4000-memory.dmp

                                      Filesize

                                      336KB

                                    • memory/2520-1895-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1875-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1882-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1885-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1887-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1893-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2520-1891-0x00000000048F0000-0x0000000004A02000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2860-18708-0x00000000064F0000-0x00000000067AA000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/2860-45-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-24-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-18880-0x00000000064F0000-0x00000000067AA000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/2860-17-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-19-0x00000000012B1000-0x0000000001319000-memory.dmp

                                      Filesize

                                      416KB

                                    • memory/2860-67-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-48-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-18707-0x00000000064F0000-0x00000000067AA000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/2860-47-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-18720-0x0000000006E30000-0x00000000074D2000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/2860-20-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-66-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-46-0x00000000012B1000-0x0000000001319000-memory.dmp

                                      Filesize

                                      416KB

                                    • memory/2860-7321-0x0000000006E30000-0x0000000007688000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/2860-23-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-7547-0x0000000006E30000-0x0000000007688000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/2860-16155-0x0000000006E30000-0x00000000074D2000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/2860-22-0x00000000012B0000-0x00000000015D7000-memory.dmp

                                      Filesize

                                      3.2MB

                                    • memory/2860-12797-0x0000000006E30000-0x0000000007688000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/4028-13622-0x0000000000400000-0x0000000000C58000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/4028-19180-0x0000000000400000-0x0000000000C58000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/4028-7459-0x0000000000400000-0x0000000000C58000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/4360-18710-0x0000000000EE0000-0x000000000119A000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/4360-18713-0x0000000000EE0000-0x000000000119A000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/4360-19072-0x0000000000EE0000-0x000000000119A000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/4360-18714-0x0000000000EE0000-0x000000000119A000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/4924-19231-0x00000000027A0000-0x00000000027A8000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4924-19230-0x000000001B560000-0x000000001B842000-memory.dmp

                                      Filesize

                                      2.9MB

                                    • memory/5108-19158-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/5108-18941-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/5108-18942-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/5752-19213-0x000000013FD80000-0x0000000140210000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/6100-16502-0x0000000001230000-0x00000000018D2000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/6100-17614-0x0000000001230000-0x00000000018D2000-memory.dmp

                                      Filesize

                                      6.6MB

                                    • memory/6992-19160-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/6992-18945-0x000000013F8A0000-0x000000013FD30000-memory.dmp

                                      Filesize

                                      4.6MB

                                    • memory/7080-19042-0x000000001B590000-0x000000001B872000-memory.dmp

                                      Filesize

                                      2.9MB

                                    • memory/7080-19094-0x0000000002990000-0x0000000002998000-memory.dmp

                                      Filesize

                                      32KB