Overview

overview

10

Static

static

3

263d1cf6ee...7f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 00:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    263d1cf6ee0322a2e320c3fd5baf21547085d56c0b7d3226f27ea52eed0ec17f.exe

  • Size

    7.1MB

  • MD5

    bcb9ddcac56508c24f8ec88615480d05

  • SHA1

    62efebb82170cba13b7e1261da12260bda4eb696

  • SHA256

    263d1cf6ee0322a2e320c3fd5baf21547085d56c0b7d3226f27ea52eed0ec17f

  • SHA512

    8d189946684041cd0d0fd7f8869bc782c55baf5bacf9ac7f36aeacdc043b6e9e95a2c2065ceeda1ab5bbeda66a9c9070870383aa387eb247c56feb0076995a31

  • SSDEEP

    196608:ET+NaTZPK7rKeccgnie77tGVej4+STJvL1h3ii:EFjTn3tGVe6Nz1h

Score
10/10
amadeycryptbotlummastealc9c9aa5stokcredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 21 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 42 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 21 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:696
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4284
    • C:\Users\Admin\AppData\Local\Temp\263d1cf6ee0322a2e320c3fd5baf21547085d56c0b7d3226f27ea52eed0ec17f.exe
      "C:\Users\Admin\AppData\Local\Temp\263d1cf6ee0322a2e320c3fd5baf21547085d56c0b7d3226f27ea52eed0ec17f.exe"
      1⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o7B55.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o7B55.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\O8D66.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\O8D66.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F15c3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F15c3.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3976
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4084
              • C:\Users\Admin\AppData\Local\Temp\1016214001\4ipQYBO.exe
                "C:\Users\Admin\AppData\Local\Temp\1016214001\4ipQYBO.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3144
              • C:\Users\Admin\AppData\Local\Temp\1016223001\bEp1dJF.exe
                "C:\Users\Admin\AppData\Local\Temp\1016223001\bEp1dJF.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3044
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1912
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1136
                  7⤵
                  • Program crash
                  PID:1980
              • C:\Users\Admin\AppData\Local\Temp\1016385001\09a71f1daf.exe
                "C:\Users\Admin\AppData\Local\Temp\1016385001\09a71f1daf.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Drops startup file
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2832
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /Query /TN "09a71f1daf"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:6384
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /sc onlogon /tn "09a71f1daf" /tr "C:\Users\Admin\AppData\Local\Temp\1016385001\09a71f1daf.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:6464
                • C:\Windows\SysWOW64\attrib.exe
                  "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\1016385001\09a71f1daf.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:6292
              • C:\Users\Admin\AppData\Local\Temp\1016386001\7764f46e66.exe
                "C:\Users\Admin\AppData\Local\Temp\1016386001\7764f46e66.exe"
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1256
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 776
                  7⤵
                  • Program crash
                  PID:1908
              • C:\Users\Admin\AppData\Local\Temp\1016387001\e00d68a022.exe
                "C:\Users\Admin\AppData\Local\Temp\1016387001\e00d68a022.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:4604
                • C:\Users\Admin\AppData\Local\Temp\1016387001\e00d68a022.exe
                  "C:\Users\Admin\AppData\Local\Temp\1016387001\e00d68a022.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:864
              • C:\Users\Admin\AppData\Local\Temp\1016388001\2ee42aa4bc.exe
                "C:\Users\Admin\AppData\Local\Temp\1016388001\2ee42aa4bc.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4208
              • C:\Users\Admin\AppData\Local\Temp\1016389001\8e4f106378.exe
                "C:\Users\Admin\AppData\Local\Temp\1016389001\8e4f106378.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:2720
              • C:\Users\Admin\AppData\Local\Temp\1016390001\811ca7da37.exe
                "C:\Users\Admin\AppData\Local\Temp\1016390001\811ca7da37.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:1100
                • C:\Users\Admin\AppData\Local\Temp\JPNND0NEBHG00B3ZPZAX23N.exe
                  "C:\Users\Admin\AppData\Local\Temp\JPNND0NEBHG00B3ZPZAX23N.exe"
                  7⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1196
                • C:\Users\Admin\AppData\Local\Temp\K3OVUUBZJ6EJRA61DKHUXY.exe
                  "C:\Users\Admin\AppData\Local\Temp\K3OVUUBZJ6EJRA61DKHUXY.exe"
                  7⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:4364
              • C:\Users\Admin\AppData\Local\Temp\1016391001\1c86aa5851.exe
                "C:\Users\Admin\AppData\Local\Temp\1016391001\1c86aa5851.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:2088
              • C:\Users\Admin\AppData\Local\Temp\1016392001\47b8d4815e.exe
                "C:\Users\Admin\AppData\Local\Temp\1016392001\47b8d4815e.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3872
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3252
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4008
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1876
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1820
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3844
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:4920
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1100
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1960 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5cf7ac7-27e7-4662-88c8-8e1d1bfb3154} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" gpu
                        9⤵
                          PID:1032
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2472 -prefMapHandle 2468 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3d6b916-72f0-4488-b025-6425d3499107} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" socket
                          9⤵
                            PID:860
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 2724 -prefMapHandle 3180 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {658ec625-663b-4d7c-a397-83e719dcf33e} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" tab
                            9⤵
                              PID:4596
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3988 -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {152c7c9b-dea4-41dd-ad2d-abbe815350fa} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" tab
                              9⤵
                                PID:4616
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4836 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4784 -prefMapHandle 4820 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fd9468c-9d78-4c6e-9a8d-846088515bd7} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" utility
                                9⤵
                                • Checks processor information in registry
                                PID:6344
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 5436 -prefMapHandle 4808 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19833f16-7f2c-4d4c-8414-134774aef35b} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" tab
                                9⤵
                                  PID:5384
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 4 -isForBrowser -prefsHandle 5632 -prefMapHandle 5516 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44eac4a5-18a0-4808-9756-1e507e49d950} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" tab
                                  9⤵
                                    PID:5408
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85f59d1d-c3f2-4252-8e1d-6a4bfcf977bf} 1100 "\\.\pipe\gecko-crash-server-pipe.1100" tab
                                    9⤵
                                      PID:5412
                              • C:\Users\Admin\AppData\Local\Temp\1016393001\4edd1fa5ac.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016393001\4edd1fa5ac.exe"
                                6⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3448
                              • C:\Users\Admin\AppData\Local\Temp\1016394001\2dd37fd6f6.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016394001\2dd37fd6f6.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                PID:6116
                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2T0494.exe
                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2T0494.exe
                            4⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2272
                            • C:\Users\Admin\AppData\Local\Temp\1SA9KUJ6T4H20GM7W.exe
                              "C:\Users\Admin\AppData\Local\Temp\1SA9KUJ6T4H20GM7W.exe"
                              5⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:712
                            • C:\Users\Admin\AppData\Local\Temp\TB9O7JT5JWV9OOPFVZJ.exe
                              "C:\Users\Admin\AppData\Local\Temp\TB9O7JT5JWV9OOPFVZJ.exe"
                              5⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1592
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                6⤵
                                • Uses browser remote debugging
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:4760
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffeec7dcc40,0x7ffeec7dcc4c,0x7ffeec7dcc58
                                  7⤵
                                    PID:3552
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1872 /prefetch:2
                                    7⤵
                                      PID:3060
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2380 /prefetch:3
                                      7⤵
                                        PID:1792
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2388 /prefetch:8
                                        7⤵
                                          PID:3188
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                                          7⤵
                                          • Uses browser remote debugging
                                          PID:344
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
                                          7⤵
                                          • Uses browser remote debugging
                                          PID:3524
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4532 /prefetch:1
                                          7⤵
                                          • Uses browser remote debugging
                                          PID:2256
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
                                          7⤵
                                            PID:3496
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2960,i,7736886019520447903,17889791781659613637,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
                                            7⤵
                                              PID:1148
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                            6⤵
                                            • Uses browser remote debugging
                                            • Enumerates system info in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1736
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffee8d946f8,0x7ffee8d94708,0x7ffee8d94718
                                              7⤵
                                                PID:3448
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                                                7⤵
                                                  PID:3236
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                                                  7⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2416
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:2
                                                  7⤵
                                                    PID:4684
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
                                                    7⤵
                                                      PID:4292
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      PID:1248
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      PID:624
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                                      7⤵
                                                        PID:1764
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2456 /prefetch:2
                                                        7⤵
                                                          PID:4144
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2708 /prefetch:2
                                                          7⤵
                                                            PID:1112
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2940 /prefetch:2
                                                            7⤵
                                                              PID:5072
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2940 /prefetch:2
                                                              7⤵
                                                                PID:4856
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4600 /prefetch:2
                                                                7⤵
                                                                  PID:384
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                                                                  7⤵
                                                                  • Uses browser remote debugging
                                                                  PID:4940
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                                                  7⤵
                                                                  • Uses browser remote debugging
                                                                  PID:4236
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15825673088659288976,3693813376562274974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
                                                                  7⤵
                                                                    PID:1608
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IDHJEBGIEB.exe"
                                                                  6⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4864
                                                                  • C:\Users\Admin\Documents\IDHJEBGIEB.exe
                                                                    "C:\Users\Admin\Documents\IDHJEBGIEB.exe"
                                                                    7⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3248
                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3E20W.exe
                                                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3E20W.exe
                                                            3⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2296
                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y707Y.exe
                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y707Y.exe
                                                          2⤵
                                                          • Modifies Windows Defender Real-time Protection settings
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Windows security modification
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4072
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3044 -ip 3044
                                                        1⤵
                                                          PID:4792
                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                          1⤵
                                                            PID:4236
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                            1⤵
                                                              PID:3420
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1256 -ip 1256
                                                              1⤵
                                                                PID:4072
                                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                PID:1708
                                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                PID:5768

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Create or Modify System Process

                                                              1
                                                              T1543

                                                              Windows Service

                                                              1
                                                              T1543.003

                                                              Modify Authentication Process

                                                              1
                                                              T1556

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Create or Modify System Process

                                                              1
                                                              T1543

                                                              Windows Service

                                                              1
                                                              T1543.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              Hide Artifacts

                                                              1
                                                              T1564

                                                              Hidden Files and Directories

                                                              1
                                                              T1564.001

                                                              Impair Defenses

                                                              2
                                                              T1562

                                                              Disable or Modify Tools

                                                              2
                                                              T1562.001

                                                              Modify Authentication Process

                                                              1
                                                              T1556

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Virtualization/Sandbox Evasion

                                                              3
                                                              T1497

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Modify Authentication Process

                                                              1
                                                              T1556

                                                              Steal Web Session Cookie

                                                              1
                                                              T1539

                                                              Unsecured Credentials

                                                              5
                                                              T1552

                                                              Credentials In Files

                                                              5
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Query Registry

                                                              9
                                                              T1012

                                                              System Information Discovery

                                                              5
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Virtualization/Sandbox Evasion

                                                              3
                                                              T1497

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              4
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\mozglue.dll
                                                                Filesize

                                                                593KB

                                                                MD5

                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                SHA1

                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                SHA256

                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                SHA512

                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                Download Submit

                                                              • C:\ProgramData\nss3.dll
                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                SHA1

                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                SHA256

                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                SHA512

                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                Filesize

                                                                649B

                                                                MD5

                                                                08bc7ef29d4f5b01d45faff95020d30f

                                                                SHA1

                                                                f83e8bbbbc6085074b09f484fb73cce1aa41b377

                                                                SHA256

                                                                86507026d9514e7c3eff8fac70393728381b5043db1a80b77d665e03202e0973

                                                                SHA512

                                                                a091e05d168c2845b738ff6b02bf03abecaaa25ed97fa186b49d9e1d9ba3c28830f4e655bf0b976c816ced1d40139ffaf770ea3b1531526fa7db5ebc85e2f5fd

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                Filesize

                                                                14B

                                                                MD5

                                                                ef48733031b712ca7027624fff3ab208

                                                                SHA1

                                                                da4f3812e6afc4b90d2185f4709dfbb6b47714fa

                                                                SHA256

                                                                c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

                                                                SHA512

                                                                ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                61cef8e38cd95bf003f5fdd1dc37dae1

                                                                SHA1

                                                                11f2f79ecb349344c143eea9a0fed41891a3467f

                                                                SHA256

                                                                ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                                                                SHA512

                                                                6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                0a9dc42e4013fc47438e96d24beb8eff

                                                                SHA1

                                                                806ab26d7eae031a58484188a7eb1adab06457fc

                                                                SHA256

                                                                58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                                                                SHA512

                                                                868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                9e81c91050624d171b00264150332c82

                                                                SHA1

                                                                f8d0ba6d0d705ae806ed05896a0698a332904c64

                                                                SHA256

                                                                a29ab029e7d65eaa90ddc18dd531cdf2c660555b78ca1265e75aea965e217bbd

                                                                SHA512

                                                                01b9e2fb23a49e5a633e278f1a5a326b988e2740dcccf2342870f7327c1f85d914219d42262a055a6eccf55202f61366d599a7461fbb91af5c79acd063f5fbf6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                Filesize

                                                                16B

                                                                MD5

                                                                206702161f94c5cd39fadd03f4014d98

                                                                SHA1

                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                SHA256

                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                SHA512

                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                Filesize

                                                                16B

                                                                MD5

                                                                46295cac801e5d4857d09837238a6394

                                                                SHA1

                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                SHA256

                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                SHA512

                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                Filesize

                                                                11B

                                                                MD5

                                                                838a7b32aefb618130392bc7d006aa2e

                                                                SHA1

                                                                5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                SHA256

                                                                ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                SHA512

                                                                9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                Filesize

                                                                264KB

                                                                MD5

                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                SHA1

                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                SHA256

                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                SHA512

                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json
                                                                Filesize

                                                                21KB

                                                                MD5

                                                                5851f819f1fb12db37561008a9c25241

                                                                SHA1

                                                                8c3dceadae21c9da2ef558a60f7a7721ed767dd8

                                                                SHA256

                                                                25f3c7c9ec49b2382e6d864f89d24fc53f247c14c2c9e8a4eee34a9b3fc884d5

                                                                SHA512

                                                                0290d09d6eb1e6510199e937535fc30b7ad39a1d23cbe455f35c864e7bfa8762545cfb8b6c3ab05a44af6c1c4bc19aea73909bd1ce0792eb21997e5e2e6bf43c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                                                Filesize

                                                                13KB

                                                                MD5

                                                                b3d32f1efbed88ecebbf823067b6696c

                                                                SHA1

                                                                6950cd7700a461aea7f44200d6e6c0217395145f

                                                                SHA256

                                                                cb54344b415c4665604b36171ed78573f194d9bc607e64a85ee8b84a0580d167

                                                                SHA512

                                                                7f0f3c959c735962e98bdf8d60f4b6ef5c05bbf52ca8c287694c9ad1027ca6b25088bd5cd361bf2cfb153e9ef76053b70350c7fde6801f23950875d185f2f094

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                Filesize

                                                                15KB

                                                                MD5

                                                                96c542dec016d9ec1ecc4dddfcbaac66

                                                                SHA1

                                                                6199f7648bb744efa58acf7b96fee85d938389e4

                                                                SHA256

                                                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                SHA512

                                                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016214001\4ipQYBO.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                fd17d712c627b434e99749cfc82c7d51

                                                                SHA1

                                                                bf00a1fe4d9efc63e963751201a383bf9df7d25e

                                                                SHA256

                                                                af8729a17698880e54e9f23b48e6b68d73672179f58868c201c8cf54d1a578bc

                                                                SHA512

                                                                b3f56a4457df967d9355f42316e8332813c46003b4d2e216fbabded7edcddcbefc72ee01fd706722cf81e2fb3e0986c31358a22270f7b36106e77a88b6c25c85

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016223001\bEp1dJF.exe
                                                                Filesize

                                                                709KB

                                                                MD5

                                                                c299bc91f8ff13b5c061ae547a904b39

                                                                SHA1

                                                                8e417e07a1b7a14c07c0d607fc2ca1443de92ee1

                                                                SHA256

                                                                d9e68de0e0928d896b9e53ed2068744cc539bca74508cd0a544540f3cd64d5d4

                                                                SHA512

                                                                79fc6b6ac7d2c3ae5cab4db34002ad8d90fef944c9696135d1b60f53b6f76bcb6b6395b3e66b46269012e05a11d5a3fc4413b4cfda19542fb41f7ac7cb156c45

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016385001\09a71f1daf.exe
                                                                Filesize

                                                                1.7MB

                                                                MD5

                                                                d37dab4c59e707f632bb0b91eaa87ff9

                                                                SHA1

                                                                0e153debcf54805a0543646620511b57865d6fc9

                                                                SHA256

                                                                375a067be10250dc045ea14025444ad7ec0662cf189abbbd393e6f7ffe85b35d

                                                                SHA512

                                                                0ae81abbe56f0a20c8066c52672d969c962a20b19c7e7165b12c7b16a4f0681c4f96ce2cedde50ade5975ced262d581fc99d0947c188cec847c8a82eb85bc0ae

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016386001\7764f46e66.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                e77d6f82f6ac60e5d6d7bdfc595e4890

                                                                SHA1

                                                                d71c11f0596885d81e195530ede5be7f36a6a1df

                                                                SHA256

                                                                3cdad55d54fe131588ce90d5524a8fac0c0a3f36093b1c6fc4bc099e9e805894

                                                                SHA512

                                                                842b147ce19200c882e315d1d7c07ead557b6db18d32bb70e3161865720bda7a1ae49387b0c725514a1b98a8585b508cfc4a5062fcf1d6cde4d2b4a47e31858f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016387001\e00d68a022.exe
                                                                Filesize

                                                                710KB

                                                                MD5

                                                                28e568616a7b792cac1726deb77d9039

                                                                SHA1

                                                                39890a418fb391b823ed5084533e2e24dff021e1

                                                                SHA256

                                                                9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                                                                SHA512

                                                                85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016388001\2ee42aa4bc.exe
                                                                Filesize

                                                                4.2MB

                                                                MD5

                                                                85cea0d2fa18da07d24daa648971117a

                                                                SHA1

                                                                0b50f57223bef54f682715f7944267a419004cb4

                                                                SHA256

                                                                845229081df392891048243c2c4b8502c10b68eacf8345d515ed5d0485c24bd0

                                                                SHA512

                                                                a460a2c1552b44c5df55203c90bcba0603fc39ef106bfdd9ae95751c48788f132318fb7dc5a1d8560a33fc548ec8f5204ae4a295bea3160854773ead08b343c0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016389001\8e4f106378.exe
                                                                Filesize

                                                                4.2MB

                                                                MD5

                                                                0c9ac016b38263da875782e7fd32cd5c

                                                                SHA1

                                                                c81138a0fd251982dd17ec26efa677a84babbc39

                                                                SHA256

                                                                51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0

                                                                SHA512

                                                                b0f023a55887b60c1eb432caf2db4a4d90eab5838fd8411e7e7b606da3fa9a53ce8a65f153f9d3ce30cfce82d848a5aae3637bbfca01872233a304efff99a197

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016390001\811ca7da37.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                33f9e889016b41140afdad01332d5a26

                                                                SHA1

                                                                f4de250dbaa6b3f9c8801498526e0bc22ad340a5

                                                                SHA256

                                                                599086e8d07adba2a1da0154abc7ec0c3517e4b13ed3f2cb0c6091bde27cc1eb

                                                                SHA512

                                                                40bc464738fe493630dc133edec1f7e02c5ae3aa8999a911636e3ba071b6e2080400f73d02f4f268526b0fa218d30a35361a7df69309c67b0e470be2392344b1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1016392001\47b8d4815e.exe
                                                                Filesize

                                                                950KB

                                                                MD5

                                                                65ad21f7a8a47263b4c7acd943efd140

                                                                SHA1

                                                                a1379c3fe6fafffc6ab6ec7e4003d7e18802402d

                                                                SHA256

                                                                4c0367bc660cf73465b5e1e9f47aff22709c05abbd3b5fdb88b9aef577d117d6

                                                                SHA512

                                                                3044c95db4b3dcf71ad55251fbb998bdde71b7baaaad093f874d53fb133b7a22e4912e2dcc1b863d81488fb0eaa367ff5bceebba1367a277849926b918d6a928

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\1SA9KUJ6T4H20GM7W.exe
                                                                Filesize

                                                                1.7MB

                                                                MD5

                                                                c07b01af18efd92367ed44ab96bb6562

                                                                SHA1

                                                                18484683aafa4933e4ffd59640b4ea9df33d2cd8

                                                                SHA256

                                                                ff16e4b2824ca8102e810f3101d709ffa1f09aca620d07872183cbb4af64b441

                                                                SHA512

                                                                9d5b830a270c0198bb9788f10758a1fffe83c130d21eebd6a5c2590032d6fcd36cf2958ab794b4283a98a9e38e0a842878fc474ae3ba5c4d659eec9acdf17b8d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y707Y.exe
                                                                Filesize

                                                                1.6MB

                                                                MD5

                                                                5627434dcd51ad8e6ccd2f2e910244b7

                                                                SHA1

                                                                34d10cae708d0a50b771e27c4e3fa341119bffa8

                                                                SHA256

                                                                c2cb09db1f95c2786c59842f48adfc1bc4f89a039066f5848c4b7a6743a6c173

                                                                SHA512

                                                                4a8fef280317f2f95eb61d1f1fa502a1666dd6f29edae97132dd7d25fe789f0a20f6d7b922bba5519ff7775aacebf4471213fd23b026d174260b3e1ef74ba149

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o7B55.exe
                                                                Filesize

                                                                5.4MB

                                                                MD5

                                                                ff9d41538a5cdbeb34f228c481876e85

                                                                SHA1

                                                                2ea42106c9a8eea0a1d11ab7114409c305f83e95

                                                                SHA256

                                                                5d2d2e9f97d9cf9f152f679f65e521392b152593421f154b9bacc769c2faba02

                                                                SHA512

                                                                ae9e23d8b2c6c56c6c9280c8533e01575dd17d42a794e6bfc28b56c9b758358c21b897288e108f993ace8261255885a2e88a624751d7199a89d9ab270f30bcb2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3E20W.exe
                                                                Filesize

                                                                2.8MB

                                                                MD5

                                                                378c6fb769071786359387f4775f1956

                                                                SHA1

                                                                0f6f0969ce99c10885acf1c55bbd6786d8665db5

                                                                SHA256

                                                                d6d93e9798642ad2e081b4eaa8c99c09803b4ae8d5d700c6c9dd764ddd0f70c4

                                                                SHA512

                                                                7e33c67a4a4a95836fcd484ff72684b43e2c36c842c5ed5b2101c41b08ad514004799f9774f540d0c060f84c17442f79b629ba99103ca84fd31c231aba671e50

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\O8D66.exe
                                                                Filesize

                                                                3.7MB

                                                                MD5

                                                                fd2276c345b6dc0c103a28165d54ac71

                                                                SHA1

                                                                51563867710d08b5ed68eb089c12c71e494a3cf6

                                                                SHA256

                                                                7909ee5a0a0e2417ef87c97fbaf6989ab651c3a23eed0dc1c5757d5c486e5527

                                                                SHA512

                                                                a816f39413e39c85ded06b80c6c0d517eef3306b9aedc1bc3c373e701d2e61a0fb29065720f242bceeeca72312da3fe0dc8f7175c976a91a4633fb015f6cc3f2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1F15c3.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                0a33d6a84e76fbe67e55cb586eee180e

                                                                SHA1

                                                                128121b3c02799a5878179b2105081fb186a00d2

                                                                SHA256

                                                                2991c28484a6cbf790d2b9cc6e55e0dd4b24b5d94eed9b1ab4a6ba23ad7a9e4d

                                                                SHA512

                                                                d9e816bc9bdd8d6cd2249bf6b868f2aa9e1cb7420b4c3989517e313f25bd874b11427a88cb406b7dd8e2c81b4ceabd064b49f03402540630d75a9849a47db9c2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2T0494.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                d904d432f6ec77928f1330ed4afc1d73

                                                                SHA1

                                                                0b525e00fdc7b989e2725f0e03c93185deac6c24

                                                                SHA256

                                                                ecc41494eae1e27988859b355d7911b7efb5186b57dbd3b77a85dce3f0b4935a

                                                                SHA512

                                                                794a1548d71e2fdfad7da8c3d71e458eaf07c5f1aec2a98a6c8cd34115fc23341fad53879daef89db14f6a807d0e5bbc528e493bd798a49e8ab7773a86ec48df

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\TB9O7JT5JWV9OOPFVZJ.exe
                                                                Filesize

                                                                2.7MB

                                                                MD5

                                                                b4c1dba163af3b5402e1746b69c964ed

                                                                SHA1

                                                                71efe2f7ec13586ae2578c60a56f23732392bc2c

                                                                SHA256

                                                                7ec038e9dd03aebc33ae61653612825040d6ede00bc677f73e1ae6c13378dd3c

                                                                SHA512

                                                                ce80a035481af64cfb46370ea38daa4ba86ba5341579e34a3e82debb14c7599b1512d35229502655a9307c4e3557276248dba7baa971af4444290d7e6533ecdc

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                Filesize

                                                                479KB

                                                                MD5

                                                                09372174e83dbbf696ee732fd2e875bb

                                                                SHA1

                                                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                SHA256

                                                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                SHA512

                                                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                Filesize

                                                                13.8MB

                                                                MD5

                                                                0a8747a2ac9ac08ae9508f36c6d75692

                                                                SHA1

                                                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                SHA256

                                                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                SHA512

                                                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                be0e726b45aef6a49847e77eecfd19e0

                                                                SHA1

                                                                936e7b52987174bded841e594ebbb32a532c778b

                                                                SHA256

                                                                3a32d890a0f7535eb0d5d9bd90e665f18e10661627151afb11075113ffe1e23c

                                                                SHA512

                                                                659e4381d1970033f418d5ace0c29d734fee20aa305ec6e3a7087deb62ca2fcb20fa6dae61b4eddca0a029bf05779a99cd0267de89b9e31b12a45bd4b876eaa5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.bin
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                75061fe4d291e2eb9a40344e688047a4

                                                                SHA1

                                                                e28ccdc840798fcf37e7a3fc1a0ddfe81ffec2ef

                                                                SHA256

                                                                d2825107909482cfeae39a0d5684e4ef4422cc6bee62e0f635982edaa83f2b11

                                                                SHA512

                                                                f05da4386a63dabb82c3d727f3aaa45014dc74bf6f04ed49a2989e88a2e2cf60a350230b169e71ff87876da45af196a76fb1eb50322d83d50d07fb0c1521d77d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.bin
                                                                Filesize

                                                                24KB

                                                                MD5

                                                                0f54bafb09ca55b8db3cf6b2f75e672a

                                                                SHA1

                                                                7d6c303ca0f603ffc8a9497bd8cf0f34247edd69

                                                                SHA256

                                                                c045725e893b8a92d3c0dc8c225dea2828d371fc7f38347190f67b737d789467

                                                                SHA512

                                                                f31f59231857e74ad760ad0e2105052f6a437e0f290e8bec34182ce9ebc83343bec696cd600841791a527ca32782062ea95ee3aeea9573c28e276b79bd16aec1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.bin
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                0cff2bb368152ab58b0a531ce4e5435b

                                                                SHA1

                                                                d65036b15bf50dda72da4c5182436bf3f7ed619b

                                                                SHA256

                                                                8820d39f5821be1097a29c1447d139e71c8d3a1319cd4d62ae5c733f5978ce77

                                                                SHA512

                                                                c7573c97d2596bc8da6bc1a263698a5703eea18aecb112140ccc95725c370b2095821523fb34d7e864108ad7f830e5f43d67e063478501fae43cb76aded9600b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                21KB

                                                                MD5

                                                                5263466450e4d4224a6f2571d57c2003

                                                                SHA1

                                                                ff75781f130ba3da9222679c600b7508ebf6b613

                                                                SHA256

                                                                35f32fa869520b5f003b91a2a794e61f16d87a35142d03b0748be17947b81909

                                                                SHA512

                                                                871d6d61cae22270684e1cfef84b261a7c7b334d937e4604e4ed889a420da52619e62723ed2a385d49511db9d6d4f99894c78baf1b1688588066f353185533b8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                d8fc5b6ebfd63a22dfb95a30ddf69e69

                                                                SHA1

                                                                285daf8c2777e5f5fbb4461dfa7846c8d72327cd

                                                                SHA256

                                                                f237726305ce8fe986fe8941e1f73b37fb68ee38880934a61baf26b966786e22

                                                                SHA512

                                                                51545cadc5a02d2d39cc0fee5f5037bf0d99f1a0867d0197435a737fce702078a2b244be12f197eaf3d50af8c835ff7821767c96827891f95c96dfe40e134ec7

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                24KB

                                                                MD5

                                                                674e540f485c5a22d296f64ac4cf6834

                                                                SHA1

                                                                e50430cded8c9c931b6e01dcbcaf65926638ce7a

                                                                SHA256

                                                                090b7219775624138311728101950d807bdb5be0c4d57b730cdee87f969b9683

                                                                SHA512

                                                                761ad66930a6fc90a171f1e5ee5fd1ab45c1b4dd644c6c862797ffbfa5038fbe0ff877f9c0d932a0252d8304e00aa5e64fc1b05f0fd34ddfc9467a8500567c0d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                24KB

                                                                MD5

                                                                43b0cb452d94ca9118f61a2cd9623201

                                                                SHA1

                                                                a9353f0cbf9b58eec22060c2ceba093fcf29064b

                                                                SHA256

                                                                dc39b6443f60f03071bf49ea26845e28b0eeb08759b7baa8955da42dae42185b

                                                                SHA512

                                                                fb9cce84a238f5a30f7e92adf10af607487c3e6bee150299b8322ed8f0e7e7613e55be2adc0b84440da45c3954cd3fb27372ded29789019dfa1947d01cdc0acb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\3be38284-ce8d-4feb-a54f-daa22cd2b599
                                                                Filesize

                                                                659B

                                                                MD5

                                                                1ce67ec54fd756a711e207dc622fa40d

                                                                SHA1

                                                                6d4014f2eb2e924602a95da1a9d1ba69322f36db

                                                                SHA256

                                                                9ae41a70d195a72d6fa71ebb74094c121c4c59754c29461740334dd0fafccf42

                                                                SHA512

                                                                54aaac53c238c66781ba8999a088c415ce34ca85abca5c79d2dd48cba18d242d57535018d05c74bd75bada74a1b4fdcb8c0a5ec5852cb28b760478f0d51efb94

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\9bea1a94-ff70-4954-a3b8-28acce40e6d9
                                                                Filesize

                                                                982B

                                                                MD5

                                                                3138c1f06ebe0805ee0edbca19b8ea9d

                                                                SHA1

                                                                f129ebd01a628831c8c2f67d90d36aca70bffd8a

                                                                SHA256

                                                                bfb82a8441934eabdf848999249ad0665a8e410b6f0a0a026ac510c3d3b1b571

                                                                SHA512

                                                                2a2936529efa07bd376b4d31c5eb442898dc64e56a9747c0e25acd8ccc3f842234223c56415d079cce3b8df22d1fb5c6d895837d7de8f1c25d76daa42794feac

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                842039753bf41fa5e11b3a1383061a87

                                                                SHA1

                                                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                SHA256

                                                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                SHA512

                                                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                Filesize

                                                                116B

                                                                MD5

                                                                2a461e9eb87fd1955cea740a3444ee7a

                                                                SHA1

                                                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                SHA256

                                                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                SHA512

                                                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                                Filesize

                                                                372B

                                                                MD5

                                                                bf957ad58b55f64219ab3f793e374316

                                                                SHA1

                                                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                SHA256

                                                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                SHA512

                                                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                                Filesize

                                                                17.8MB

                                                                MD5

                                                                daf7ef3acccab478aaa7d6dc1c60f865

                                                                SHA1

                                                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                SHA256

                                                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                SHA512

                                                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                950a093e334f5b69a0011f2adfddb35f

                                                                SHA1

                                                                0bbf8e9f9f1b7804b9f55ceae451ded7ac41c0ca

                                                                SHA256

                                                                8feedfeb78d31ccc99b180f1d36891d0909c596a8ea22036995f5a8bfe985484

                                                                SHA512

                                                                7061018c488a9eeae5f6d22fe756b5e8ceb09594c0ef5ca63283e3bd47b6ca99af42c0f37d872d60ead3c2ea024268631a14e93433ed9d1a7f4f246198e68231

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                c113b80a795884d6fe8fb6bcec06558d

                                                                SHA1

                                                                3d1c0c124b4e2267e5a12ffe51cfa24ad84921ab

                                                                SHA256

                                                                10cd2b05d8ff513fe0960e2216c38cbfb4c6214e885bc9df1fe71121b2d66a16

                                                                SHA512

                                                                d6fb316eb4a551b26124a54e2feaf19609f5f3cca68ba82fea379d9596f8555927cd7a1dd4dabdb4192c4531164ddf9f592744a72ef854be0d8a5495b7cd3969

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js
                                                                Filesize

                                                                15KB

                                                                MD5

                                                                f4ef09f9944fdd8f02158fd7bd67264a

                                                                SHA1

                                                                03b69c7a6b2ed7e307dd35a34cae9e3d72a72c67

                                                                SHA256

                                                                b816a7bca72488939397b15eb9cae6144df5388a8e97a3974263369e702dbce1

                                                                SHA512

                                                                02760657de18dc6f6f84785432b95935fd6281eb7423a6553c2d640ba5ab3d263c3b064ed3774a37fb54336837adba95c2b7cc2ad72b48b4118a7f57602b6778

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                f29f3418132dbaaeda98752647bd29cd

                                                                SHA1

                                                                997a42bac1c0cce1cf4473a3d2492984f50d7a19

                                                                SHA256

                                                                1349bfd723d9a88dd0081222ea4849423b25ea8751cccba40d49083c4f1b85c7

                                                                SHA512

                                                                0d6fd231f95d607110c0c1fe98ea03ffe3a48c3c650dc00840d586bf20274861517eb55a2216ebe4dec1f6ac7b45fc59226067983d16d478ee11ec26a0fc682c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\gdi32.dll
                                                                Filesize

                                                                417KB

                                                                MD5

                                                                016370d35f13013e081b67f55e20aba8

                                                                SHA1

                                                                b0ad8fc7b8adf8d969840bfa80b7c8868af209db

                                                                SHA256

                                                                8b409a2f186559e9f9b9528a76ad1913eca20d601173fcc858e13a23e07517ef

                                                                SHA512

                                                                1df0a8afd1bb0819b310123504b0640666a0680bd43cceca0530372fa22eb6399710b1e8b014b843c748ca82bfedc148a04bf95a515f2c03fac1af0a6c2d5911

                                                                Download Submit

                                                              • C:\Users\Admin\Documents\IDHJEBGIEB.exe
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                7cf236240d235f35fbfd37f4abfed7cd

                                                                SHA1

                                                                eb904f17eabb2837a239e3c6b55490657a3a00c7

                                                                SHA256

                                                                da8d837276d6ed969359c92e63e8bb6d9c3531f48dd84358031978939b0ca1e4

                                                                SHA512

                                                                91aa97e27ea392efc654fd6737875dcf910ac3630f55cb2140782a49a7bc108df55a5292613fe01fdee9e63b46ac768e62c1e41299f93e9e4f240e6d2c426a8f

                                                                Download Submit

                                                              • memory/712-163-0x0000000000880000-0x0000000000CDE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/712-44-0x0000000000880000-0x0000000000CDE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/712-53-0x0000000000880000-0x0000000000CDE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/712-174-0x0000000000880000-0x0000000000CDE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/712-54-0x0000000000880000-0x0000000000CDE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/864-288-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/864-292-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/864-290-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/1100-490-0x00000000000E0000-0x000000000058E000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1100-437-0x00000000000E0000-0x000000000058E000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1196-466-0x0000000000EA0000-0x00000000012FE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/1196-1217-0x0000000000EA0000-0x00000000012FE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/1196-1122-0x0000000000EA0000-0x00000000012FE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/1196-467-0x0000000000EA0000-0x00000000012FE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/1196-462-0x0000000000EA0000-0x00000000012FE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/1256-205-0x00000000048F0000-0x0000000004CF0000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/1256-208-0x0000000075E10000-0x0000000076025000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/1256-194-0x0000000000280000-0x0000000000740000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/1256-206-0x00007FFF09D90000-0x00007FFF09F85000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/1256-204-0x00000000048F0000-0x0000000004CF0000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/1256-225-0x0000000000280000-0x0000000000740000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/1592-175-0x0000000000E30000-0x0000000001318000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/1592-110-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                Filesize

                                                                972KB

                                                                Download

                                                              • memory/1592-392-0x0000000000E30000-0x0000000001318000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/1592-201-0x0000000000E30000-0x0000000001318000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/1592-347-0x0000000000E30000-0x0000000001318000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/1592-69-0x0000000000E30000-0x0000000001318000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/1708-382-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/1708-383-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/1912-107-0x00000000737E0000-0x0000000073837000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/1912-102-0x00000000737E0000-0x0000000073837000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/1912-103-0x00000000737E0000-0x0000000073837000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/1912-108-0x00000000737E0000-0x0000000073837000-memory.dmp

                                                                Filesize

                                                                348KB

                                                                Download

                                                              • memory/2088-465-0x0000000000180000-0x0000000000668000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/2088-458-0x0000000000180000-0x0000000000668000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/2272-39-0x0000000000FC0000-0x000000000145B000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/2272-68-0x0000000000FC0000-0x000000000145B000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/2296-415-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2296-193-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2296-202-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2296-74-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2296-348-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2296-411-0x00000000003B0000-0x00000000008A8000-memory.dmp

                                                                Filesize

                                                                5.0MB

                                                                Download

                                                              • memory/2720-410-0x0000000000F80000-0x0000000001BF3000-memory.dmp

                                                                Filesize

                                                                12.4MB

                                                                Download

                                                              • memory/2720-412-0x0000000000F80000-0x0000000001BF3000-memory.dmp

                                                                Filesize

                                                                12.4MB

                                                                Download

                                                              • memory/2832-167-0x0000000000280000-0x00000000006DE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/2832-164-0x0000000000280000-0x00000000006DE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/2832-166-0x0000000000280000-0x00000000006DE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/2832-1237-0x0000000009480000-0x00000000094E6000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/2832-1226-0x0000000008600000-0x000000000861E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/2832-1225-0x0000000007A80000-0x0000000007AF6000-memory.dmp

                                                                Filesize

                                                                472KB

                                                                Download

                                                              • memory/2832-295-0x0000000000280000-0x00000000006DE000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/3044-95-0x00000000016F0000-0x00000000016F6000-memory.dmp

                                                                Filesize

                                                                24KB

                                                                Download

                                                              • memory/3044-94-0x0000000000FC0000-0x000000000107A000-memory.dmp

                                                                Filesize

                                                                744KB

                                                                Download

                                                              • memory/3144-109-0x0000000000780000-0x0000000000C1D000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/3144-61-0x0000000000780000-0x0000000000C1D000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/3248-393-0x0000000000060000-0x000000000038B000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                                Download

                                                              • memory/3248-390-0x0000000000060000-0x000000000038B000-memory.dmp

                                                                Filesize

                                                                3.2MB

                                                                Download

                                                              • memory/3448-519-0x0000000000DB0000-0x000000000120E000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/3448-520-0x0000000000DB0000-0x000000000120E000-memory.dmp

                                                                Filesize

                                                                4.4MB

                                                                Download

                                                              • memory/3976-35-0x0000000000ED0000-0x000000000139F000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/3976-21-0x0000000000ED0000-0x000000000139F000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4072-468-0x0000000000A40000-0x0000000000E8E000-memory.dmp

                                                                Filesize

                                                                4.3MB

                                                                Download

                                                              • memory/4072-438-0x0000000000A40000-0x0000000000E8E000-memory.dmp

                                                                Filesize

                                                                4.3MB

                                                                Download

                                                              • memory/4072-439-0x0000000000A40000-0x0000000000E8E000-memory.dmp

                                                                Filesize

                                                                4.3MB

                                                                Download

                                                              • memory/4072-500-0x0000000000A40000-0x0000000000E8E000-memory.dmp

                                                                Filesize

                                                                4.3MB

                                                                Download

                                                              • memory/4072-418-0x0000000000A40000-0x0000000000E8E000-memory.dmp

                                                                Filesize

                                                                4.3MB

                                                                Download

                                                              • memory/4084-1218-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-216-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-33-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-1657-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-4196-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-63-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-491-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-1262-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-83-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-4694-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-4735-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-356-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4084-413-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/4208-414-0x00000000003A0000-0x0000000000FB7000-memory.dmp

                                                                Filesize

                                                                12.1MB

                                                                Download

                                                              • memory/4208-351-0x00000000003A0000-0x0000000000FB7000-memory.dmp

                                                                Filesize

                                                                12.1MB

                                                                Download

                                                              • memory/4208-409-0x00000000003A0000-0x0000000000FB7000-memory.dmp

                                                                Filesize

                                                                12.1MB

                                                                Download

                                                              • memory/4208-421-0x00000000003A0000-0x0000000000FB7000-memory.dmp

                                                                Filesize

                                                                12.1MB

                                                                Download

                                                              • memory/4284-209-0x0000000000220000-0x000000000022A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4284-215-0x0000000075E10000-0x0000000076025000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/4284-212-0x0000000000A00000-0x0000000000E00000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/4284-213-0x00007FFF09D90000-0x00007FFF09F85000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/4364-496-0x0000000000990000-0x0000000000E78000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/4364-492-0x0000000000990000-0x0000000000E78000-memory.dmp

                                                                Filesize

                                                                4.9MB

                                                                Download

                                                              • memory/5768-4615-0x0000000000530000-0x00000000009FF000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                                Download

                                                              • memory/6116-1228-0x0000000000090000-0x000000000052D000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download