Overview

overview

10

Static

static

3

e1028c6edc...8b.exe

windows7-x64

10

e1028c6edc...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1028c6edc84ebb9c7296ab660010a7d6fde9ea1666f3975bce4006e581dce8b.exe

  • Size

    2.8MB

  • MD5

    5fa7006ac7d77bd8e84fbdffbfb43c3a

  • SHA1

    96bea0fb316e2bc686e59a854ff710d23c2ae333

  • SHA256

    e1028c6edc84ebb9c7296ab660010a7d6fde9ea1666f3975bce4006e581dce8b

  • SHA512

    b457d24ec19ddc03b86d320198d5f1baade7100658b1e3fff22f5d50fdf57f1e0d9f2194294836cf3d6f38bce38ab1a8a20041d653fd00bd6de9489d33cfaffc

  • SSDEEP

    24576:vnoE0Bh9uoVLwGVObpqzHHu8Jy3wXPJcxrTwGwZDZx9T6vjfjZvXQFCqrADrceTb:vol9PV0qzHHu8JDfzzp+1TDrPvXCdg

Score
10/10
amadeycryptbotlummastealcxmrig9c9aa5stokdiscoveryevasionminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

https://shineugler.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    evasion
  • XMRig Miner payload 13 IoCs
    miner
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1028c6edc84ebb9c7296ab660010a7d6fde9ea1666f3975bce4006e581dce8b.exe
    "C:\Users\Admin\AppData\Local\Temp\e1028c6edc84ebb9c7296ab660010a7d6fde9ea1666f3975bce4006e581dce8b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\1016118001\61eccaa20b.exe
        "C:\Users\Admin\AppData\Local\Temp\1016118001\61eccaa20b.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:3812
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2404
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_7.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1940
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2968
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3792
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3248
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1476
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2944
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3036
            • C:\Windows\system32\attrib.exe
              attrib +H "in.exe"
              5⤵
              • Views/modifies file attributes
              PID:2520
            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
              "in.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1652
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:4504
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:1444
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1220
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.0.0.1; del in.exe
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1600
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1488
        • C:\Users\Admin\AppData\Local\Temp\1016119001\4e59fa058a.exe
          "C:\Users\Admin\AppData\Local\Temp\1016119001\4e59fa058a.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:60
          • C:\Users\Admin\AppData\Local\Temp\1016119001\4e59fa058a.exe
            "C:\Users\Admin\AppData\Local\Temp\1016119001\4e59fa058a.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4916
        • C:\Users\Admin\AppData\Local\Temp\1016120001\48e8fa6580.exe
          "C:\Users\Admin\AppData\Local\Temp\1016120001\48e8fa6580.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4864
          • C:\Users\Admin\AppData\Local\Temp\9FKA8096IZJJTXYAFQE3570KLKAZ.exe
            "C:\Users\Admin\AppData\Local\Temp\9FKA8096IZJJTXYAFQE3570KLKAZ.exe"
            4⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:708
          • C:\Users\Admin\AppData\Local\Temp\FN5J2YGV7VSYILCN5.exe
            "C:\Users\Admin\AppData\Local\Temp\FN5J2YGV7VSYILCN5.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3300
        • C:\Users\Admin\AppData\Local\Temp\1016121001\cb039d7286.exe
          "C:\Users\Admin\AppData\Local\Temp\1016121001\cb039d7286.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4648
        • C:\Users\Admin\AppData\Local\Temp\1016122001\7afdeeb58f.exe
          "C:\Users\Admin\AppData\Local\Temp\1016122001\7afdeeb58f.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2548
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4428
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3056
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2308
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3888
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1460
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:3728
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:3316
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240401114208 -prefsHandle 1832 -prefMapHandle 1816 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17097acc-b5e2-4f7a-8139-8d3db2e891bd} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" gpu
                  6⤵
                    PID:2140
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6715422b-475a-45e9-9674-4380aff9ab24} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" socket
                    6⤵
                      PID:672
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3260 -childID 1 -isForBrowser -prefsHandle 3284 -prefMapHandle 2700 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b95a07c-3902-43be-8e07-5b99b977b7fa} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" tab
                      6⤵
                        PID:3812
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2536 -childID 2 -isForBrowser -prefsHandle 1164 -prefMapHandle 3180 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ad2b926-07ce-428d-b7dd-cb6829677497} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" tab
                        6⤵
                          PID:4352
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4052 -prefMapHandle 4204 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6810e15-da58-462a-97cc-5e6205fec6e8} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5680
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5436 -prefMapHandle 5312 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dabb95bc-b524-4c34-8eaa-a9b5bee07c78} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" tab
                          6⤵
                            PID:5536
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 4 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e50a0bf-6d6d-4385-b453-08b3049cf5d7} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" tab
                            6⤵
                              PID:5564
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea6c5f1e-c19d-4d65-ab22-5f9726887b6a} 3316 "\\.\pipe\gecko-crash-server-pipe.3316" tab
                              6⤵
                                PID:5576
                        • C:\Users\Admin\AppData\Local\Temp\1016123001\3285fc3f8b.exe
                          "C:\Users\Admin\AppData\Local\Temp\1016123001\3285fc3f8b.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1456
                        • C:\Users\Admin\AppData\Local\Temp\1016124001\17e7943885.exe
                          "C:\Users\Admin\AppData\Local\Temp\1016124001\17e7943885.exe"
                          3⤵
                          • Enumerates VirtualBox registry keys
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5932
                        • C:\Users\Admin\AppData\Local\Temp\1016125001\81757a945b.exe
                          "C:\Users\Admin\AppData\Local\Temp\1016125001\81757a945b.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:572
                        • C:\Users\Admin\AppData\Local\Temp\1016126001\9bdeec1520.exe
                          "C:\Users\Admin\AppData\Local\Temp\1016126001\9bdeec1520.exe"
                          3⤵
                          • Enumerates VirtualBox registry keys
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5528
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5904
                    • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2460
                      • C:\Windows\explorer.exe
                        explorer.exe
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4192
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                        2⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5392
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.1.10.1
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2040
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4788
                    • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1988
                      • C:\Windows\explorer.exe
                        explorer.exe
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:772
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                        2⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4568
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.1.10.1
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1920

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Modify Registry

                    3
                    T1112

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    3
                    T1552

                    Credentials In Files

                    3
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    8
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    3
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      6cf293cb4d80be23433eecf74ddb5503

                      SHA1

                      24fe4752df102c2ef492954d6b046cb5512ad408

                      SHA256

                      b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                      SHA512

                      0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      1KB

                      MD5

                      80b848029a962d01e755862bf5268e1c

                      SHA1

                      a0ddb7f512d85939702a4849036a2a561b6e4c37

                      SHA256

                      de7c9d8caa42f51b8e67229a773e40548f31aedcefcb212d74d448f1582898a7

                      SHA512

                      7da223bc60cc79fcad6d5690f964c0ad842a05088d5a35f0b45ef9869a2cd29102c1a2c40139fa26b8f3dcc4571c266de9461866076428ad5f31924adc7354b0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      1KB

                      MD5

                      276798eeb29a49dc6e199768bc9c2e71

                      SHA1

                      5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                      SHA256

                      cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                      SHA512

                      0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json.tmp
                      Filesize

                      19KB

                      MD5

                      5aa1b549e174c3a8d8c1f5d32b23edcb

                      SHA1

                      59f3ee64d2188d309ca9545adf4cb838eb3088a5

                      SHA256

                      4888c1ffb9dd2c37172a1904c72cd331a59dc264506914bab04dceb924b8a651

                      SHA512

                      feb6b049a4dc1d827b45275bf9ca657cb0c5487785b7da1bfe24bac195c684aa611cc5667e36de71710aa8be0acb8bca94e071ef6b30d5dab8da3b3ce217e9d9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                      Filesize

                      13KB

                      MD5

                      56795309125427dde0a2953532673bea

                      SHA1

                      784a37eaad2f7b281971457abf799dca17a76a33

                      SHA256

                      a01bb24a03d0e4baf6fc5cb056366b75e34f4c5a9be4be999ac95cebce97ffff

                      SHA512

                      679be903096ccabc626f53b44048701a8542c42d864047c1c88f123da6f41e567a0522605785b505959b4bbc11a63bc2e399d3d404d947c1c94ce5a6b55fa73c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016118001\61eccaa20b.exe
                      Filesize

                      4.2MB

                      MD5

                      3a425626cbd40345f5b8dddd6b2b9efa

                      SHA1

                      7b50e108e293e54c15dce816552356f424eea97a

                      SHA256

                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                      SHA512

                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016119001\4e59fa058a.exe
                      Filesize

                      710KB

                      MD5

                      28e568616a7b792cac1726deb77d9039

                      SHA1

                      39890a418fb391b823ed5084533e2e24dff021e1

                      SHA256

                      9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                      SHA512

                      85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016120001\48e8fa6580.exe
                      Filesize

                      1.8MB

                      MD5

                      591c23cae68a9c792a7eb65cebc40b52

                      SHA1

                      8099f5a9458238225dd7d12811a0e57961b1d8b0

                      SHA256

                      ef123e56243004263637a0ec051578cebffbbe35f1d9cff18b4d9936ddd2d2a0

                      SHA512

                      23c3ddb2f9a72c7aedfd5a4f7d1eeff8bb2a6d5be4e4170470286276b6e37ad4580c596ec3f692171f9c74ca41362c8cf4ebf97339059409db661575c6c9b03e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016121001\cb039d7286.exe
                      Filesize

                      1.7MB

                      MD5

                      87e63bbbf528355861c2f28f5c751e76

                      SHA1

                      8e1038641ed17b8ac3951ee56f279672a8b2816b

                      SHA256

                      3273a28282c9bb96a6355c4bac2ec26dbf6711ce24a0ec2213b1e08087ecfc62

                      SHA512

                      a55b3fb4a4d9613d21aa354b040e7868591de3835836363bdc12f613347ed0d642fe984944725c3d56c0f02fe9a102c5d7f4d9bc898395166104b404abc49018

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016122001\7afdeeb58f.exe
                      Filesize

                      947KB

                      MD5

                      4e6cb53529bdb1273cc85b9e42d6174d

                      SHA1

                      c9dae4115ee0bd5ccc1c684290c869cb77e39aeb

                      SHA256

                      e49279f916beed88680a5eafcdf0817f0a59c7ed74d7455159764ec37e27d7f2

                      SHA512

                      bebba017827f047030504eb52273dc20143d42f7f6898cf42fecdd5d5d11bd64de1166f251d7e218d699c665bed2383dc8355c5696ef6638076f5a14fd50016e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016124001\17e7943885.exe
                      Filesize

                      4.2MB

                      MD5

                      fef2f997dcd3ef91d2b2e41b6db77467

                      SHA1

                      c262e269030aa5bebd10843bc17348003e304599

                      SHA256

                      e3dacf687e1075ab0d4604b8ff6d927ca89262bd32d21070513b71a3fc325c20

                      SHA512

                      0fd27bd187cc2c1d6defdcefedabfa2929274354eecb2ecf694d764626d4bc3fe28cc7c567cfa1975f251320b1d31daae8977f9ea75368ed38e56172ad6b5a42

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016125001\81757a945b.exe
                      Filesize

                      1.7MB

                      MD5

                      6c1d0dabe1ec5e928f27b3223f25c26b

                      SHA1

                      e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                      SHA256

                      92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                      SHA512

                      3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1016126001\9bdeec1520.exe
                      Filesize

                      4.3MB

                      MD5

                      64cfdc9caeaefbc21aeb85e1a82b3153

                      SHA1

                      ed719eaddd2875b2d590d0c14d036b42c8601cbc

                      SHA256

                      095372c51df528243c88389b2d833560eb4621cf213d8c6a0190d39e0ec0f24a

                      SHA512

                      cca4c8857c59ef279695caaf7b6065af95977f624dafdf5a71000cf9dcee3b24b39b417b3ed8faa67b161d88f195f37655222f51926b64e16db7b9f46a71f4bd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\9FKA8096IZJJTXYAFQE3570KLKAZ.exe
                      Filesize

                      2.7MB

                      MD5

                      9f03bec1eb3f1ca31f05a88032785af3

                      SHA1

                      22568558f099114825dd153219d6a7b42dd733f8

                      SHA256

                      3ba985b655bfd53fd92104dce30d476d42e050f6e5a10a638d2fb31fda56c97c

                      SHA512

                      0114f778c85c5229390c591747d52c59890d4a2a3f5fdad2c0c26af40083ce52525ef27499290e4ec92c84ee6efe8fd0c0f91df25c4ee03816ec574f5c9feba9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkyzurwy.5jr.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      Filesize

                      2.8MB

                      MD5

                      5fa7006ac7d77bd8e84fbdffbfb43c3a

                      SHA1

                      96bea0fb316e2bc686e59a854ff710d23c2ae333

                      SHA256

                      e1028c6edc84ebb9c7296ab660010a7d6fde9ea1666f3975bce4006e581dce8b

                      SHA512

                      b457d24ec19ddc03b86d320198d5f1baade7100658b1e3fff22f5d50fdf57f1e0d9f2194294836cf3d6f38bce38ab1a8a20041d653fd00bd6de9489d33cfaffc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                      Filesize

                      1.6MB

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      Filesize

                      458KB

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
                      Filesize

                      2.2MB

                      MD5

                      579a63bebccbacab8f14132f9fc31b89

                      SHA1

                      fca8a51077d352741a9c1ff8a493064ef5052f27

                      SHA256

                      0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

                      SHA512

                      4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
                      Filesize

                      1.7MB

                      MD5

                      5659eba6a774f9d5322f249ad989114a

                      SHA1

                      4bfb12aa98a1dc2206baa0ac611877b815810e4c

                      SHA256

                      e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

                      SHA512

                      f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                      Filesize

                      1.7MB

                      MD5

                      5404286ec7853897b3ba00adf824d6c1

                      SHA1

                      39e543e08b34311b82f6e909e1e67e2f4afec551

                      SHA256

                      ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

                      SHA512

                      c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                      Filesize

                      1.7MB

                      MD5

                      5eb39ba3698c99891a6b6eb036cfb653

                      SHA1

                      d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                      SHA256

                      e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                      SHA512

                      6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                      Filesize

                      1.7MB

                      MD5

                      7187cc2643affab4ca29d92251c96dee

                      SHA1

                      ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                      SHA256

                      c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                      SHA512

                      27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                      Filesize

                      1.7MB

                      MD5

                      b7d1e04629bec112923446fda5391731

                      SHA1

                      814055286f963ddaa5bf3019821cb8a565b56cb8

                      SHA256

                      4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                      SHA512

                      79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                      Filesize

                      1.7MB

                      MD5

                      0dc4014facf82aa027904c1be1d403c1

                      SHA1

                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                      SHA256

                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                      SHA512

                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                      Filesize

                      3.3MB

                      MD5

                      cea368fc334a9aec1ecff4b15612e5b0

                      SHA1

                      493d23f72731bb570d904014ffdacbba2334ce26

                      SHA256

                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                      SHA512

                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                      Filesize

                      3.3MB

                      MD5

                      045b0a3d5be6f10ddf19ae6d92dfdd70

                      SHA1

                      0387715b6681d7097d372cd0005b664f76c933c7

                      SHA256

                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                      SHA512

                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                      Filesize

                      440B

                      MD5

                      3626532127e3066df98e34c3d56a1869

                      SHA1

                      5fa7102f02615afde4efd4ed091744e842c63f78

                      SHA256

                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                      SHA512

                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      Filesize

                      479KB

                      MD5

                      09372174e83dbbf696ee732fd2e875bb

                      SHA1

                      ba360186ba650a769f9303f48b7200fb5eaccee1

                      SHA256

                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                      SHA512

                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                      Filesize

                      13.8MB

                      MD5

                      0a8747a2ac9ac08ae9508f36c6d75692

                      SHA1

                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                      SHA256

                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                      SHA512

                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      Filesize

                      1.7MB

                      MD5

                      83d75087c9bf6e4f07c36e550731ccde

                      SHA1

                      d5ff596961cce5f03f842cfd8f27dde6f124e3ae

                      SHA256

                      46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

                      SHA512

                      044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                      Filesize

                      10KB

                      MD5

                      9b8a15d2271b8562aad798a4cdabf9db

                      SHA1

                      2262de13cc600d689b3d5b84d1f16934c6564051

                      SHA256

                      ca205e136776fac4e59af43f418ece1852c60e0bf28c9310bbf0ed9943a9b196

                      SHA512

                      d2ebbd92c1576e112c55c34d669349be0ac0dc9dd806f04bd1756a22dd8facdf240d62733609671345bb6e0b973e05356d066333b697025a835a0f36bf828cbb

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\cert9.db
                      Filesize

                      224KB

                      MD5

                      d9ebe6dadeda578f96f417af7a603908

                      SHA1

                      5ddca9556380ce0458f38161eaa070d552f767c8

                      SHA256

                      8313a9cf093db51877714f864dcbb9e56934ddeef7ac8092f669345074e92431

                      SHA512

                      e97ce057170d5d875a40633ec10db8a909f4477c2ad5f4e119f5a245f1195be5caa19a1bc1f2a2754091e48824de9e707cccf339fe44941dabe2aa9b62cfa340

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      5KB

                      MD5

                      d4e5eedf0f52c1237252e60adf0f58e8

                      SHA1

                      29d612b7cd4c0be14c73f78a673176f0a14cea14

                      SHA256

                      610464d58fde32f49a09be0a2cdf6d26a7b585a690343ccac2cae387657dd77d

                      SHA512

                      9c6167df604ea22935be8faa17d0d043a25631c20ed677d6f44afc002456357f39111928f9b31b6d6ba20a221424f21a709cc5dd9a5acdb2319ba14e81bafd59

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                      Filesize

                      15KB

                      MD5

                      a20d0c931877b6f26b15fc30b820055b

                      SHA1

                      7f133d49f626fe15e77d91332d5df1b96da1a978

                      SHA256

                      dcb35edebb927bcc233f5f4048d24d420634794437ce6a46bff6e2c722aecc76

                      SHA512

                      7808f485ba60ae89e03c5afe2af5ffc7f97b169dc738f2c1d101f3f9278e04345717708b9f06b01abf4cafbe3b1d32a62fdad9d4526eaaa2dba8a1531a85bd64

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\48e3e57c-d16a-435f-8384-8148d4f8fe3f
                      Filesize

                      28KB

                      MD5

                      bef92b257f0155bd0a3f0259d3132eeb

                      SHA1

                      edadcef5c1b1cf82ab36583fa2b31bdf8fa18b11

                      SHA256

                      fd5eef59fa367712327b41c59821b7ba15db55a508c213288269b578ae283826

                      SHA512

                      1804ea186d9cb919cc08c4daf9e72272c834aa34cf262875910386827de0dfa656788e8de903a8d75870bbb6330e25e6842c06ed79ebd12cbb3b43b8966c8a7f

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\946583ab-7e56-4caa-aae8-841f50761713
                      Filesize

                      671B

                      MD5

                      34840c89308853ee1dfcc60a8be3768c

                      SHA1

                      6f6c11dd595303f82854cefada05dec3817702a7

                      SHA256

                      e1e4924c5ec4a2d77178d73ac3797fba47b7f47c793125dff2f4a471b564c83f

                      SHA512

                      780433e9eca73b49cb9718617d924d48d76670293d2ca0b656643eb7ae57f21ebec3c628380ce31a2a42cda8f157765a1e000bddf1f45f9319f8bb52c4c90d68

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\a502f3eb-4075-493d-ad94-e3e9859febe8
                      Filesize

                      982B

                      MD5

                      286d331698ebee1aa5c9fe0fd6c374b3

                      SHA1

                      58409bf9804de1af1f12819920c655580b6eac29

                      SHA256

                      39a0912d536fe18d0e4578df27d3708ce5e8afaa0ec63b51019698ad1cce707c

                      SHA512

                      677f868b6393dd3ae61e0812f23c75842533922670028f09a17d708502ce8737e99c596f7de628d216a82896dba56de7b5046f33052ad077ca517f87c7c5e62e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                      Filesize

                      1.1MB

                      MD5

                      842039753bf41fa5e11b3a1383061a87

                      SHA1

                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                      SHA256

                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                      SHA512

                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                      Filesize

                      116B

                      MD5

                      2a461e9eb87fd1955cea740a3444ee7a

                      SHA1

                      b10755914c713f5a4677494dbe8a686ed458c3c5

                      SHA256

                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                      SHA512

                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                      Filesize

                      372B

                      MD5

                      bf957ad58b55f64219ab3f793e374316

                      SHA1

                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                      SHA256

                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                      SHA512

                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                      Filesize

                      17.8MB

                      MD5

                      daf7ef3acccab478aaa7d6dc1c60f865

                      SHA1

                      f8246162b97ce4a945feced27b6ea114366ff2ad

                      SHA256

                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                      SHA512

                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                      Filesize

                      12KB

                      MD5

                      ce6968791cf53e2e9104e3df351667ba

                      SHA1

                      386402d6173df671ba770d340bd64c97343ae5f8

                      SHA256

                      1e7f6dd257bc2663e9681c44492e6963e7165f3dfd71843c320ce35848c02540

                      SHA512

                      baedcd48f3dcc32dadc0d3a29392d3866af47bcbf3d694f889ff600eb56fead8e31cb079b50e1c3f0f92b973e4d07a0921f87be36f8b19790b7abd8776070a8d

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                      Filesize

                      15KB

                      MD5

                      a4bdab7077ca257649719bcd48cff7ed

                      SHA1

                      fb17bf9de820ff6914f3060a3d107bdf24fc3527

                      SHA256

                      0b2ead6f71f3a521ee57f9422967ff79822b97d81c2984f5a8b037bf4c50151e

                      SHA512

                      5ea1ccb73dd4a933655f925ab2aeac4fa636b7da7cb8385d4258e7c098ee50fff6ff089cd0ee43f6a2e24aa35150283f5d5260eaf5bb7b536e69a5a724c8f606

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                      Filesize

                      10KB

                      MD5

                      eb488e8b227a51b3c5997915230a3f1d

                      SHA1

                      0a29af42090954d84a9cda86554d04c770bcb53c

                      SHA256

                      ab828d1f696910acba72cdf4f6484a69e6ae7e12f13767b2629328bfbdc0d896

                      SHA512

                      37e57055fe7067eaf9926fb90d1d5949b91094658bdae987a2254fc1956155a9110d98ed5f979928bb9c66061c4682341661ac3aeea5337f2c61a72caa3890b5

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                      Filesize

                      11KB

                      MD5

                      b824d310f0e92a5b794bcb02db13d302

                      SHA1

                      541156180b7858866420e5b9e8b7516739deb7dc

                      SHA256

                      15f868ebedfef677779e1d8ef4041d22e4901222ac07c85e165e5055726f114e

                      SHA512

                      b3a31eac74ec9d8b0744b7f446a487c32a5372059a75ac2d18ee169cb1f7898ebc28cf94df703842cd93325d82c6dc39d16a106c1789b4ed575a7837575ec8d2

                      Download Submit

                    • memory/572-632-0x00000000004F0000-0x000000000097B000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/572-645-0x00000000004F0000-0x000000000097B000-memory.dmp

                      Filesize

                      4.5MB

                      Download

                    • memory/708-584-0x0000000000B00000-0x0000000000DC8000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/708-610-0x0000000000B00000-0x0000000000DC8000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/708-186-0x0000000000B00000-0x0000000000DC8000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/708-205-0x0000000000B00000-0x0000000000DC8000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/708-206-0x0000000000B00000-0x0000000000DC8000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/772-2931-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/772-2929-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/772-2927-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/1456-242-0x0000000000CC0000-0x0000000000F88000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/1456-235-0x0000000000CC0000-0x0000000000F88000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/1456-636-0x0000000000CC0000-0x0000000000F88000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/1456-616-0x0000000000CC0000-0x0000000000F88000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/1456-244-0x0000000000CC0000-0x0000000000F88000-memory.dmp

                      Filesize

                      2.8MB

                      Download

                    • memory/1600-142-0x0000020235DF0000-0x0000020235E12000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/1652-130-0x00007FF7C3440000-0x00007FF7C38D0000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/1988-2930-0x00007FF7284E0000-0x00007FF728970000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2460-781-0x00007FF7284E0000-0x00007FF728970000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2460-820-0x00007FF7284E0000-0x00007FF728970000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2584-1-0x0000000077254000-0x0000000077256000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2584-0-0x0000000000D30000-0x0000000001040000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2584-2-0x0000000000D31000-0x0000000000D5F000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/2584-3-0x0000000000D30000-0x0000000001040000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2584-4-0x0000000000D30000-0x0000000001040000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2584-16-0x0000000000D30000-0x0000000001040000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3300-213-0x00000000005C0000-0x0000000000C44000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/3300-215-0x00000000005C0000-0x0000000000C44000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/3548-2944-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-646-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-87-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-129-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-71-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-128-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-48-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2913-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2911-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-23-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-22-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-21-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-20-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-19-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-583-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2905-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2901-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-1978-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2942-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-913-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2945-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-2946-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-17-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-181-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/3548-18-0x0000000000E51000-0x0000000000E7F000-memory.dmp

                      Filesize

                      184KB

                      Download

                    • memory/4192-782-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-795-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-818-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-817-0x0000000000A00000-0x0000000000A20000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4192-816-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-806-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-808-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-792-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-805-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-836-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-784-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4192-793-0x0000000140000000-0x0000000140770000-memory.dmp

                      Filesize

                      7.4MB

                      Download

                    • memory/4648-178-0x0000000000570000-0x0000000000BF4000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/4648-180-0x0000000000570000-0x0000000000BF4000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/4788-2916-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/4788-2915-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/4864-211-0x0000000000F30000-0x00000000013E7000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4864-160-0x0000000000F30000-0x00000000013E7000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/4916-143-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                      Download

                    • memory/4916-145-0x0000000000400000-0x0000000000457000-memory.dmp

                      Filesize

                      348KB

                      Download

                    • memory/5528-664-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-2315-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-2902-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-2907-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-2906-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-957-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5528-930-0x0000000000970000-0x00000000015E6000-memory.dmp

                      Filesize

                      12.5MB

                      Download

                    • memory/5904-681-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/5904-684-0x0000000000E50000-0x0000000001160000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/5932-648-0x0000000000810000-0x0000000001429000-memory.dmp

                      Filesize

                      12.1MB

                      Download

                    • memory/5932-647-0x0000000000810000-0x0000000001429000-memory.dmp

                      Filesize

                      12.1MB

                      Download

                    • memory/5932-601-0x0000000000810000-0x0000000001429000-memory.dmp

                      Filesize

                      12.1MB

                      Download