Overview

overview

10

Static

static

3

e5b32ba4f7...7b.exe

windows7-x64

10

e5b32ba4f7...7b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 05:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe

  • Size

    2.9MB

  • MD5

    0f299dff09ef0812a445f45f955ce8b2

  • SHA1

    08479f8270aefa0c901f42131a8c805577689de1

  • SHA256

    e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b

  • SHA512

    2539b8d7516e5230e70aa20dcac3d712b38c6d7a13b923ae88ad8c52b20e70ae715f8f64232c4153486d943569eba6a2abff5e3ce6c21b25b3c5852544ebda04

  • SSDEEP

    49152:18GUOiFKP0FB56S2xmkHdcd7grPT/VL6Gx2NNmP3s:1p0FB56jx5c5gXNGG1P3s

Score
10/10
amadeycryptbotgurculummastealc9c9aa5fed3aastokcredential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7807236140:AAF-i5R6XuCUIDX7jhwiW3NW21ELWWQOTo0/sendMessag

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 26 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 52 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 62 IoCs
  • Identifies Wine through registry keys 2 TTPs 26 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 13 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2528
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3768
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4944
    • C:\Users\Admin\AppData\Local\Temp\e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe
      "C:\Users\Admin\AppData\Local\Temp\e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Users\Admin\AppData\Local\Temp\1007364001\e3d8370f09.exe
          "C:\Users\Admin\AppData\Local\Temp\1007364001\e3d8370f09.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4532
        • C:\Users\Admin\AppData\Local\Temp\1007365001\f96ac37a02.exe
          "C:\Users\Admin\AppData\Local\Temp\1007365001\f96ac37a02.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3508
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 568
            4⤵
            • Program crash
            PID:3064
        • C:\Users\Admin\AppData\Local\Temp\1007366001\69821db333.exe
          "C:\Users\Admin\AppData\Local\Temp\1007366001\69821db333.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2588
            • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
              "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2888
              • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:844
            • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
              "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:448
              • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
                "C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2392
                • C:\Users\Admin\AppData\Local\Temp\is-I1UFF.tmp\NordVPNSetup.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-I1UFF.tmp\NordVPNSetup.tmp" /SL5="$D0044,15409387,73728,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  PID:4092
                  • C:\Windows\system32\rundll32.exe
                    "rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                    8⤵
                    • Drops file in Drivers directory
                    • Adds Run key to start application
                    PID:4280
                    • C:\Windows\system32\runonce.exe
                      "C:\Windows\system32\runonce.exe" -r
                      9⤵
                      • Checks processor information in registry
                      PID:4876
                      • C:\Windows\System32\grpconv.exe
                        "C:\Windows\System32\grpconv.exe" -o
                        10⤵
                          PID:4404
                    • C:\Windows\system32\regsvr32.exe
                      "regsvr32" "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll" /s
                      8⤵
                      • Loads dropped DLL
                      • Modifies system executable filetype association
                      • Modifies registry class
                      PID:1072
                    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                      "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:2944
                    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                      "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3688
                    • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                      "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4280
              • C:\Users\Admin\AppData\Local\Temp\1016974001\51d17e6280.exe
                "C:\Users\Admin\AppData\Local\Temp\1016974001\51d17e6280.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3240
              • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5060
              • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4964
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\mqpukgyy"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4436
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4324
                • C:\mqpukgyy\fa26dcb24d2741e8a650f4e95e8ea499.exe
                  "C:\mqpukgyy\fa26dcb24d2741e8a650f4e95e8ea499.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2460
              • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3724
              • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1528
                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4068
                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4824
              • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:820
                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5932
              • C:\Users\Admin\AppData\Local\Temp\1017374001\3b75ee8e4e.exe
                "C:\Users\Admin\AppData\Local\Temp\1017374001\3b75ee8e4e.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:216
                • C:\Users\Admin\AppData\Local\Temp\1017374001\3b75ee8e4e.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017374001\3b75ee8e4e.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6852
              • C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe
                "C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:4960
                • C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3700
                • C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1316
              • C:\Users\Admin\AppData\Local\Temp\1017376001\1efaf74ff2.exe
                "C:\Users\Admin\AppData\Local\Temp\1017376001\1efaf74ff2.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5672
              • C:\Users\Admin\AppData\Local\Temp\1017377001\35072b2673.exe
                "C:\Users\Admin\AppData\Local\Temp\1017377001\35072b2673.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:3616
              • C:\Users\Admin\AppData\Local\Temp\1017378001\6b8af85641.exe
                "C:\Users\Admin\AppData\Local\Temp\1017378001\6b8af85641.exe"
                5⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5028
              • C:\Users\Admin\AppData\Local\Temp\1017379001\1cdc491584.exe
                "C:\Users\Admin\AppData\Local\Temp\1017379001\1cdc491584.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3312
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\dnhhgdr"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5620
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3516
                • C:\dnhhgdr\17375bbd762a4d92a51e80f42c15db49.exe
                  "C:\dnhhgdr\17375bbd762a4d92a51e80f42c15db49.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5424
              • C:\Users\Admin\AppData\Local\Temp\1017380001\0c8a3305f3.exe
                "C:\Users\Admin\AppData\Local\Temp\1017380001\0c8a3305f3.exe"
                5⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 568
                  6⤵
                  • Program crash
                  PID:6352
              • C:\Users\Admin\AppData\Local\Temp\1017381001\51c47f6e8d.exe
                "C:\Users\Admin\AppData\Local\Temp\1017381001\51c47f6e8d.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1684
                • C:\Users\Admin\AppData\Local\Temp\1017381001\51c47f6e8d.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017381001\51c47f6e8d.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:632
              • C:\Users\Admin\AppData\Local\Temp\1017382001\7151625490.exe
                "C:\Users\Admin\AppData\Local\Temp\1017382001\7151625490.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:5816
              • C:\Users\Admin\AppData\Local\Temp\1017383001\9a0d5361e9.exe
                "C:\Users\Admin\AppData\Local\Temp\1017383001\9a0d5361e9.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3760
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                  6⤵
                    PID:5308
                    • C:\Windows\system32\mode.com
                      mode 65,10
                      7⤵
                        PID:4700
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6340
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_7.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6520
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_6.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7124
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_5.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6308
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_4.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6668
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_3.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6716
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_2.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7164
                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        7z.exe e extracted/file_1.zip -oextracted
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6408
                      • C:\Windows\system32\attrib.exe
                        attrib +H "in.exe"
                        7⤵
                        • Views/modifies file attributes
                        PID:1868
                      • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                        "in.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:6048
                        • C:\Windows\SYSTEM32\attrib.exe
                          attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          8⤵
                          • Views/modifies file attributes
                          PID:5452
                        • C:\Windows\SYSTEM32\attrib.exe
                          attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          8⤵
                          • Views/modifies file attributes
                          PID:5524
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                          8⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:6488
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell ping 127.0.0.1; del in.exe
                          8⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6752
                          • C:\Windows\system32\PING.EXE
                            "C:\Windows\system32\PING.EXE" 127.0.0.1
                            9⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:6316
                  • C:\Users\Admin\AppData\Local\Temp\1017384001\1caef51f04.exe
                    "C:\Users\Admin\AppData\Local\Temp\1017384001\1caef51f04.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:6036
                    • C:\Users\Admin\AppData\Local\Temp\J2IL0OJJ2DHY0C60X1BTBTCG06Y.exe
                      "C:\Users\Admin\AppData\Local\Temp\J2IL0OJJ2DHY0C60X1BTBTCG06Y.exe"
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:7024
                    • C:\Users\Admin\AppData\Local\Temp\R1VBSFOWCU46FXRS1D4KIFJ.exe
                      "C:\Users\Admin\AppData\Local\Temp\R1VBSFOWCU46FXRS1D4KIFJ.exe"
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      PID:6808
                  • C:\Users\Admin\AppData\Local\Temp\1017385001\99cebb8945.exe
                    "C:\Users\Admin\AppData\Local\Temp\1017385001\99cebb8945.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:4816
                  • C:\Users\Admin\AppData\Local\Temp\1017386001\c74a109d97.exe
                    "C:\Users\Admin\AppData\Local\Temp\1017386001\c74a109d97.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5692
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM firefox.exe /T
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6540
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM chrome.exe /T
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5608
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM msedge.exe /T
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5804
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM opera.exe /T
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4664
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /IM brave.exe /T
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3092
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                      6⤵
                        PID:644
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                          7⤵
                          • Checks processor information in registry
                          • Modifies registry class
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:6196
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93cebf48-efe7-41bf-abc4-8e37318cc0e6} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" gpu
                            8⤵
                              PID:2664
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {878bf957-dba1-4fb1-9de6-02b587999b32} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" socket
                              8⤵
                                PID:5872
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2676 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59de6977-9617-4e84-893d-47d6ffdfe4e3} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" tab
                                8⤵
                                  PID:4532
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -childID 2 -isForBrowser -prefsHandle 4200 -prefMapHandle 4196 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dab604e5-2199-433a-8f79-eef3b11d6f3c} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" tab
                                  8⤵
                                    PID:4700
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4856 -prefMapHandle 4552 -prefsLen 33301 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0836dfb8-11c3-4ca1-8376-6048c08b3d26} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" utility
                                    8⤵
                                      PID:1268
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5160 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce39d6eb-0f1c-4210-b214-20161d67621c} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" tab
                                      8⤵
                                        PID:6820
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 4 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ab36475-e4b2-47c4-9cb5-bbe35f8a996c} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" tab
                                        8⤵
                                          PID:6460
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {419a12df-2155-4d6f-940f-8ecee748b3a3} 6196 "\\.\pipe\gecko-crash-server-pipe.6196" tab
                                          8⤵
                                            PID:6572
                                    • C:\Users\Admin\AppData\Local\Temp\1017387001\0d4fd6ecc0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1017387001\0d4fd6ecc0.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      PID:6056
                                • C:\Users\Admin\AppData\Local\Temp\1007367001\f8b402920a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1007367001\f8b402920a.exe"
                                  3⤵
                                  • Enumerates VirtualBox registry keys
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3448
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3508 -ip 3508
                              1⤵
                                PID:1204
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4320
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3724
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4320
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4032
                              • C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe
                                C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
                                1⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2484
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5684 -ip 5684
                                1⤵
                                  PID:5184
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:4232
                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:3752
                                • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5912
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    2⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4048
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                    2⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6472
                                    • C:\Windows\system32\PING.EXE
                                      "C:\Windows\system32\PING.EXE" 127.1.10.1
                                      3⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:6876

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                2
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                2
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Hide Artifacts

                                1
                                T1564

                                Hidden Files and Directories

                                1
                                T1564.001

                                Modify Registry

                                2
                                T1112

                                Virtualization/Sandbox Evasion

                                3
                                T1497

                                Credential Access

                                Credentials from Password Stores

                                2
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Windows Credential Manager

                                1
                                T1555.004

                                Unsecured Credentials

                                4
                                T1552

                                Credentials In Files

                                4
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Query Registry

                                9
                                T1012

                                Remote System Discovery

                                1
                                T1018

                                System Information Discovery

                                5
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                System Network Configuration Discovery

                                1
                                T1016

                                Internet Connection Discovery

                                1
                                T1016.001

                                Virtualization/Sandbox Evasion

                                3
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                3
                                T1005

                                Command and Control

                                Web Service

                                1
                                T1102

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
                                  Filesize

                                  187KB

                                  MD5

                                  8b9964e06195fd375d126b424e236f03

                                  SHA1

                                  6f1741cfeb9fb70c34857dbba3e063c88c3c32fa

                                  SHA256

                                  bda04b693bfdea86a7a3b47f2e4ceae9cd9475c4e81b0aa73b70fd244a65f70f

                                  SHA512

                                  741019523b4c5f4ef9a7952172309b2d304a84cbd98fff99a719105cc1938157edb1691554a21b9dcd2b523c0f1ab0d37879deefc3b2fa5579c0d8c76cade483

                                  Download Submit

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                                  Filesize

                                  24.2MB

                                  MD5

                                  c8c368988a2a4c2a953b7db4bca47961

                                  SHA1

                                  5acc29b51284146a9ff7b1587c3d89416e66acdf

                                  SHA256

                                  f680e0fe00a48f6e3d079c1572682d6664f476b119745d73cb852baba58cc683

                                  SHA512

                                  5fdef1f4e3b471910fe2b12f6f6aa8bfad3f2a9c80954843085c79139823a88e0c7d921b7c01dda56871800afc20de4739682c02e9fa6a94715c64207a671b30

                                  Download Submit

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
                                  Filesize

                                  123KB

                                  MD5

                                  00d7babcb1fca39669a305acc4e6bc4e

                                  SHA1

                                  caa71de90128acf6e8d812e02aa8ba4622bf8454

                                  SHA256

                                  f0f1890de8a60f87297d6de21146977060a3b5d82e09523bced0c238e94f5d2e

                                  SHA512

                                  9f1348f6ee7325b7d3381865bda4d71807da45c941c3b40c7671df04a6558832dfd03f25f5664250b43b641117d7d3d7c71f7e81b747cbc559fc5b8169033f66

                                  Download Submit

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
                                  Filesize

                                  132KB

                                  MD5

                                  0a56b7e703bd3ed03ebaff0d1ce37be1

                                  SHA1

                                  1629651f20c63bad9b92f7a21f66a095f7ab8fc1

                                  SHA256

                                  b7727c9c2cedcef3808b677814640e3e4b486517bf66f512c543ef8d0b3a0a21

                                  SHA512

                                  9dcae642eb17514e87c7798881f501bba75d39f6addfb08f795caa6ad229bade02a16b29a54e718d608778cfbae69ea8f864e61e6908bbc7598b09aaa6ce64e1

                                  Download Submit

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                                  Filesize

                                  2KB

                                  MD5

                                  edc78deb34de240c787b1011161e9a4e

                                  SHA1

                                  2d31275530dce33d3bc329991c8ad59e1b303577

                                  SHA256

                                  69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b

                                  SHA512

                                  e55eefcc39b7353ef11a778910400c5c85cab9657bb350840988cbbf556dc343a9c1803442643c9255c149f8d93a5c2d2e6c3bea244f67c895e635eaec0a0f7b

                                  Download Submit

                                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                                  Filesize

                                  9.6MB

                                  MD5

                                  216b49b7eb7be44d7ed7367f3725285f

                                  SHA1

                                  cf0776ecbc163c738fd43767bedcc2a67acef423

                                  SHA256

                                  c6d97857b3b9f26c8e93d7b6e6481f93a16db75cbf9d1756cb29fba0fd9e240e

                                  SHA512

                                  060fb76d91bee1b421f133cae17726a68adc97ddce76a67196d10e735e216d032bee939c905b847c50f29e859dca43cdf1b19e4ae349e00efe88147224d665cb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  18KB

                                  MD5

                                  8f5625a734fde505594d03785e67b095

                                  SHA1

                                  59fc39d504b4b21790374baa5b49c4dd5aadd036

                                  SHA256

                                  7792396ad5bd0b9a67a8c4286d5f176ed55bdb2ed8d421164c647432c63f24d9

                                  SHA512

                                  f992488ec76d462e35adb2f3538576845640249047f60321f3d648e206cecc5222e1353030a0579e5a820c79823d53b08d94cf2d2e8f1d243ee4fcebb50da415

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
                                  Filesize

                                  26KB

                                  MD5

                                  7fe65429777ce3d4c6dc0cb7e06a7891

                                  SHA1

                                  1c94298240106e9d99e221ef9401f01ad21fe4bc

                                  SHA256

                                  05a32778d106f56226db97e8204868a68a1d2383790cfb955e75c21927b11bfe

                                  SHA512

                                  f42c66433bc0b4e83330ad6983af13b1bc03ce72c1870e7a0be70263ef026e4e589d1e14e0a2acde8801c23df50d566658e8659d499f39db10b1673401241c92

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                  Filesize

                                  15KB

                                  MD5

                                  96c542dec016d9ec1ecc4dddfcbaac66

                                  SHA1

                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                  SHA256

                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                  SHA512

                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1007364001\e3d8370f09.exe
                                  Filesize

                                  2.8MB

                                  MD5

                                  37bc9fc38023802a67c6b8902a8bd890

                                  SHA1

                                  a31726802dece6ee4d91dec9eab23b057bd00efe

                                  SHA256

                                  708e04b3f2d37c3cb32b2f88962676ba939525b124a757236ea3174b5b2eee74

                                  SHA512

                                  6443fe14f8e0b75d124c5fd070870bced30f339e4718c7ec2fa875284ef7e0d46945ba17a32517b13f4e814a33cdafeabcd114b579311c20e4b374243bf2fdc5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1007365001\f96ac37a02.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  c29eb2d3c39a0a808f1910e0e222ac94

                                  SHA1

                                  7270457cd535c48825b4328b9124985e7bf95be1

                                  SHA256

                                  0f5afd165ede6d66b0a86c84b534afcf9ac51c46b43c023f632aa0bf4f087819

                                  SHA512

                                  4affdc6c38038f269a51144bb22ee844918ac708e85f1c152911b0d5b82241cde79f26fd366127a0cd7cc96ecb9ac88a8b0d90677162b6f5d5e87d68b666f118

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1007366001\69821db333.exe
                                  Filesize

                                  2.8MB

                                  MD5

                                  8d64f1d7ace873c2aa994c6b8ded6ae7

                                  SHA1

                                  b1fcba92c6a6180211b8e3dcd54acf041cd0fc44

                                  SHA256

                                  4355db0995121456108e7d7630b8400f8fa6546576cdfdde15fb2a69fa616044

                                  SHA512

                                  1e9913350667af65e81798187d81164d2057a910982d3fce42bde56b41c19a1c83fb6951778a04ccb670e6c73370a52867ef6321784fc0b67bff78061e8707ab

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1007367001\f8b402920a.exe
                                  Filesize

                                  4.3MB

                                  MD5

                                  8cd346fc831e7d59ebab0de045018b84

                                  SHA1

                                  65ecbe74b5e512c9b00dbb0d041ac1f812f3cbb5

                                  SHA256

                                  ca2b0a34c077e6e81cde2626da1aca4de3f52190747d4f66636a0a8397e158c5

                                  SHA512

                                  6708a808b9300845e5852f25a380abf1ce807d96695256793c7a80ebc08307f21a6ba38bc0d73c2897c46ad2828f80717ad2f79c585c658324c7b887bf797912

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                                  Filesize

                                  3.1MB

                                  MD5

                                  f9b9f98592292b5cbf59c7a60e9ebaee

                                  SHA1

                                  59cc872fd0a11b259cc5b70893f35e9b5a7c8cbb

                                  SHA256

                                  5688e9e0becc622c573af2a1af4ee0676ef3907e38a9258a7801b46b7ad64665

                                  SHA512

                                  f27e4a96173aeb064f47d44ff445b1e15f6d4f39a4ad711c019bb29692caea56eb910970d22bc13ac5c57a256d71e77b12aa60c8405335a239781c57cb0eaf8e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                                  Filesize

                                  17.6MB

                                  MD5

                                  3c224e3fc892719dc1e302378e533579

                                  SHA1

                                  0a65062e1426a95bfeca355398b6fdc4912fb6b1

                                  SHA256

                                  64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

                                  SHA512

                                  554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1016974001\51d17e6280.exe
                                  Filesize

                                  2.9MB

                                  MD5

                                  c3ee35c8b65f7b15a8941b2dee05835e

                                  SHA1

                                  62a6c389a94fff3eb70a308b29aa7ca8444dfcc2

                                  SHA256

                                  7799197bff28707544d1c92e81250479de08e605210d39ec4b395a89e9489ccb

                                  SHA512

                                  cce2363ac083c3929839a430e0219c28da3b2d805edbb059e5c40a00ed659b9337635dadc9db86acc86993945533c4661fcaf637a22ab349306d69221b0d8789

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  ff279f4e5b1c6fbda804d2437c2dbdc8

                                  SHA1

                                  2feb3762c877a5ae3ca60eeebc37003ad0844245

                                  SHA256

                                  e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                                  SHA512

                                  c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                                  Filesize

                                  21KB

                                  MD5

                                  14becdf1e2402e9aa6c2be0e6167041e

                                  SHA1

                                  72cbbae6878f5e06060a0038b25ede93b445f0df

                                  SHA256

                                  7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                                  SHA512

                                  16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  25fb9c54265bbacc7a055174479f0b70

                                  SHA1

                                  4af069a2ec874703a7e29023d23a1ada491b584e

                                  SHA256

                                  552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                                  SHA512

                                  7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                                  Filesize

                                  1.1MB

                                  MD5

                                  ef08a45833a7d881c90ded1952f96cb4

                                  SHA1

                                  f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                                  SHA256

                                  33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                                  SHA512

                                  74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                                  Filesize

                                  1.1MB

                                  MD5

                                  68c0e4eefd4c6a76cff542ef57a49ca2

                                  SHA1

                                  8aa521628b89f3ce539269229834da2a87060e76

                                  SHA256

                                  4e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83

                                  SHA512

                                  d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017374001\3b75ee8e4e.exe
                                  Filesize

                                  3.1MB

                                  MD5

                                  c00a67d527ef38dc6f49d0ad7f13b393

                                  SHA1

                                  7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                                  SHA256

                                  12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                                  SHA512

                                  9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017375001\593e2602e0.exe
                                  Filesize

                                  758KB

                                  MD5

                                  afd936e441bf5cbdb858e96833cc6ed3

                                  SHA1

                                  3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                  SHA256

                                  c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                  SHA512

                                  928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017378001\6b8af85641.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  899d588f2750275f89657f3331e56c5d

                                  SHA1

                                  90282eec54f7d4068114d5e4a5ac42957d1babff

                                  SHA256

                                  46b7885c9b1863d30a35105d3284c460bda9904f0deaa2705371927c4a3084bf

                                  SHA512

                                  01e169a484f198aece35fe242abe1c750cd5075885c49eca561ee63db7a9edc00a902795c124d377d67e627f56535da90ebe5cc3bf9d1d2f3483424fe3ec2acf

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017381001\51c47f6e8d.exe
                                  Filesize

                                  747KB

                                  MD5

                                  8a9cb17c0224a01bd34b46495983c50a

                                  SHA1

                                  00296ea6a56f6e10a0f1450a20c5fb329b8856c1

                                  SHA256

                                  3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

                                  SHA512

                                  1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017383001\9a0d5361e9.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  3a425626cbd40345f5b8dddd6b2b9efa

                                  SHA1

                                  7b50e108e293e54c15dce816552356f424eea97a

                                  SHA256

                                  ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                  SHA512

                                  a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017384001\1caef51f04.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  75a3f7dd4f1946ba3b6908c11fc97b60

                                  SHA1

                                  0ca7014bffadc5f05553366c0407540cabbf940c

                                  SHA256

                                  1a0c403a7f94e7e1592cd2568b66f9dd23efa77b7dd8b783200d226a8d0c0e10

                                  SHA512

                                  f4bb1713c33c78bbc7e9a4b9173e1327adc325b3da7ebdcdcf05b192f93c68c493b2fbb8ba5f8a78430261afc915461a40dfe2ce90a70904193643157a8109f4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017386001\c74a109d97.exe
                                  Filesize

                                  950KB

                                  MD5

                                  945996569823aeef595820a5fb2e6990

                                  SHA1

                                  9ecabc7eba594b4e53b5e9469f2ea0ce104d30b0

                                  SHA256

                                  3c7f4833371953bed399f88946ce57a08cf2615425983df595bcbcec1dc1f5db

                                  SHA512

                                  8d0fe62b284de59d5414a9943ad97a5a32adf44847e4eb48882783dc52c1e48ccf51654981529d17e41cb45bb8f1c81d2f8bfa29dfc3b070f487b5cb41cf4d92

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1017387001\0d4fd6ecc0.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  2d0d6335887bc79a41c06f85a76e0011

                                  SHA1

                                  68c7848a94ede332ce9b8fc01d79e6e2f9e9c5da

                                  SHA256

                                  e29954c79b53a37b023e3474653eebf343493976e920cb8adecda16027fbdbc5

                                  SHA512

                                  30e265316867df8da75088e3d933d61e513ce2754a1da2565dea7791dd0b349b70c6e16b3331940bc0277369a1db303794101cc7cbbfd4cbc2ca8d916407921b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  Filesize

                                  2.9MB

                                  MD5

                                  0f299dff09ef0812a445f45f955ce8b2

                                  SHA1

                                  08479f8270aefa0c901f42131a8c805577689de1

                                  SHA256

                                  e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b

                                  SHA512

                                  2539b8d7516e5230e70aa20dcac3d712b38c6d7a13b923ae88ad8c52b20e70ae715f8f64232c4153486d943569eba6a2abff5e3ce6c21b25b3c5852544ebda04

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
                                  Filesize

                                  15.0MB

                                  MD5

                                  00fad648745710b9c4d16c4830416d80

                                  SHA1

                                  fafb219fe26e065cc11d4c12a4960447509b2a84

                                  SHA256

                                  e4561ffd0993938234d207ce56d5fe775c4ddb704f7be63003026d43eae0a337

                                  SHA512

                                  21e7b3965d1f54eb671b46e272161a426dd8a4151208b154c7fbf144725c38d593d513fb6f77cd1cef4df651266fc235a76023102b5fdc85cc8cc67da6ded847

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxxku0ag.2uq.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\is-5NC4U.tmp\b2p.dll
                                  Filesize

                                  22KB

                                  MD5

                                  ab35386487b343e3e82dbd2671ff9dab

                                  SHA1

                                  03591d07aea3309b631a7d3a6e20a92653e199b8

                                  SHA256

                                  c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2

                                  SHA512

                                  b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\is-5NC4U.tmp\botva2.dll
                                  Filesize

                                  37KB

                                  MD5

                                  67965a5957a61867d661f05ae1f4773e

                                  SHA1

                                  f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                  SHA256

                                  450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                  SHA512

                                  c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\is-5NC4U.tmp\iswin7logo.dll
                                  Filesize

                                  39KB

                                  MD5

                                  1ea948aad25ddd347d9b80bef6df9779

                                  SHA1

                                  0be971e67a6c3b1297e572d97c14f74b05dafed3

                                  SHA256

                                  30eb67bdd71d3a359819a72990029269672d52f597a2d1084d838caae91a6488

                                  SHA512

                                  f2cc5dce9754622f5a40c1ca20b4f00ac01197b8401fd4bd888bfdd296a43ca91a3ca261d0e9e01ee51591666d2852e34cee80badadcb77511b8a7ae72630545

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\is-I1UFF.tmp\NordVPNSetup.tmp
                                  Filesize

                                  920KB

                                  MD5

                                  ce14f23d9bfc00a3cc5ceb06a25030e7

                                  SHA1

                                  c63991558fb7c45555a1c4e53151bdb518b15eec

                                  SHA256

                                  5bd02d57433581efc6e14f6aefa4d1b5a52051f2ca269bde439b50658fa0bc39

                                  SHA512

                                  6497e85f1009b26fe68317a695467505e6f75270f07308ee7c321abe9b08b7ae563598b11b44629051759f321a39ec7595c0c6e48b9778146ee7f42096ff88ce

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  Filesize

                                  458KB

                                  MD5

                                  619f7135621b50fd1900ff24aade1524

                                  SHA1

                                  6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                  SHA256

                                  344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                  SHA512

                                  2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                  Filesize

                                  8KB

                                  MD5

                                  9358051d0fe14c92ba4edc7da0acf80b

                                  SHA1

                                  0e474b2b97b06e83ac992eaa297381f23eec6c31

                                  SHA256

                                  9a7568c936dbd5c839edfe516f397b88ce8b6681fd9b8ba6e381169ed0da5d1c

                                  SHA512

                                  9e08bd307e0ad26d82ccedcc224c15e0bc28175ae507afb8394b25e936db28592e5805d4634973baf30fce4a0de314d4458ba01ce64ffb08e7c63d15f6b588ba

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  6KB

                                  MD5

                                  465670c413f8e2f111607824a23f24fe

                                  SHA1

                                  d9b5ce35fcb9f60c9fd2e42c59c02330154e6c80

                                  SHA256

                                  6461c8081ca2c23fb1182a953e7cd2763b2c41dba90ab6c1a9b5839d1bc7ebb3

                                  SHA512

                                  3c5b42ad307c3190668d3cec820b648698a0a3e7cbac6b0b24e7ea68d21a1a84453a7c467989e94b366f7785d407355a1de847b10465253772969c2f19f0ea57

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  5KB

                                  MD5

                                  cb3fbd8510aca2d7d3397032d122d6d5

                                  SHA1

                                  c6ba9fc4481c950a3587f6441ecdf07628b4c3f8

                                  SHA256

                                  9beb3f04c818c7ed06753ab1651aa9a0db95e14a41d68bd95da8d1ced8b9690c

                                  SHA512

                                  cc32c5b1b8feb7a00b6f18e9acbdb51e8bfccb5964c7f9bad313829a00896c0f273b4ecbdc866371574cfe89b47344b8b87704ad15725126b94e55887957d102

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  5KB

                                  MD5

                                  5bfdd8e2ee80491819ca620aefb17c75

                                  SHA1

                                  e74e6e8c6f0942e640cc6b6e924e41c4b76967d4

                                  SHA256

                                  db8cb5fc8e763ac38f9af882fc3c4cce96978793098f69c013bf270d275a41de

                                  SHA512

                                  343b59bc27be51748c89d0e5c9333c42186ff296620ad1db8fefe5a0f2a3e1d1ad1e0778386fc2ac8b68c5c9df7ba16a4443d444045fb30b0fd89b73476c595f

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\54408ef6-250b-4dcd-92e9-5024c1d0a25d
                                  Filesize

                                  671B

                                  MD5

                                  8fbea25111f74991851dbfcbe67ed5e3

                                  SHA1

                                  9d561a566b2120685052c66b22a54daeffce9c91

                                  SHA256

                                  813aba03f5c3f888a8461fcdf88e1716440c9e3d746dc1c237197c673b39ac6e

                                  SHA512

                                  2f720c24bc3a43fb18abe88c5b3b28c38afe7ac31a4ba47af7a1c15d6be75b184baf359e57717796c41ed0648f90fc5cd1132f51899f9191cbe5a79090a5257a

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\efe66e7e-629c-451e-85e0-4fd67a73de11
                                  Filesize

                                  982B

                                  MD5

                                  89028aaf13b4c3d5f5f51614944aa6ae

                                  SHA1

                                  c8ea2da64427d8d6072e3749ded37359004206f3

                                  SHA256

                                  552490e1b2803ecbb63ae67d8cce89a69e52931ac6ee5c8da103f18c56ce0476

                                  SHA512

                                  414cab3dc03ed03150e54a205dee6734649d92e7ab10b5a4ba2b862cbcde30d4c7a671203c634796a4b7ee56cb6a44ad2e6595d78e3a924d8fd86c93c3521c1f

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\fd0ba9a5-aca0-455c-ae7a-cc9a9b10c546
                                  Filesize

                                  24KB

                                  MD5

                                  705cbe40c08db36c2ea60f0058effc90

                                  SHA1

                                  dd74c8d982a4947a278db111ef8ec95f09ed8296

                                  SHA256

                                  9635234429568916258a286ad2d04c2218880c5df181bd06ee1eab0454da8367

                                  SHA512

                                  5c37befdac6b18b8e22008da3c7ef23a2f89823e46aca77648ad131c11e86a81575d9e64413dcf77128aaa586bbe340e8ccd79394ffc6b1ef47d88836c5c66e4

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                                  Filesize

                                  11KB

                                  MD5

                                  92d6649fa8312412b8ae05f7398a3b4a

                                  SHA1

                                  ed0a54121eaa7ede59d500e314758de20379e7c4

                                  SHA256

                                  fdb0f64ec2463b53bbf4a3186e30efdbd6ff5288d164342b39ba76661db73901

                                  SHA512

                                  c2745bcf3933c3a4b7321bb5429be6f6c0e833d7bb7a515a3fd1be9d241b3fa09fe81005747c20107dfbba799d518e666d9e654b6ade67a918c988652982ea44

                                  Download Submit

                                • C:\Windows\System32\drivers\revoflt.sys
                                  Filesize

                                  37KB

                                  MD5

                                  ec8e58e6b58b4fcde77431cda3a24c0e

                                  SHA1

                                  ebb474009b2a2fbce648adff4b8b797fcd00c997

                                  SHA256

                                  25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd

                                  SHA512

                                  e2c667ebe97973ff27c1edf3e45ebf7950bc8d7aad1126da25290a2f590b21808654694cbe6a0ad1d3649566ec7645eb6b3379c7d7c0a650d5381a69e9cdade4

                                  Download Submit

                                • C:\mqpukgyy\fa26dcb24d2741e8a650f4e95e8ea499.exe
                                  Filesize

                                  1.2MB

                                  MD5

                                  577cd52217da6d7163cea46bb01c107f

                                  SHA1

                                  82b31cc52c538238e63bdfc22d1ea306ea0b852a

                                  SHA256

                                  139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

                                  SHA512

                                  8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

                                  Download Submit

                                • memory/216-669-0x0000000000AE0000-0x0000000000E08000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/448-175-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-200-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-229-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-227-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-223-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-184-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-185-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-191-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-190-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-189-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-188-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-187-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-186-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-193-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-199-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-198-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-201-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-226-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-197-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-196-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-195-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-194-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-202-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-192-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/448-225-0x0000000003FC0000-0x000000000420F000-memory.dmp

                                  Filesize

                                  2.3MB

                                  Download

                                • memory/820-610-0x0000000000470000-0x0000000000582000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/820-2771-0x0000000004F10000-0x0000000004FD0000-memory.dmp

                                  Filesize

                                  768KB

                                  Download

                                • memory/1528-675-0x0000000004C90000-0x0000000004D52000-memory.dmp

                                  Filesize

                                  776KB

                                  Download

                                • memory/1528-465-0x0000000007460000-0x0000000007486000-memory.dmp

                                  Filesize

                                  152KB

                                  Download

                                • memory/1528-449-0x0000000000290000-0x00000000003A6000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/1528-450-0x0000000007110000-0x00000000071A2000-memory.dmp

                                  Filesize

                                  584KB

                                  Download

                                • memory/1528-462-0x0000000004570000-0x000000000457A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/1960-92-0x0000000000770000-0x0000000000A80000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/1960-106-0x0000000000770000-0x0000000000A80000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2392-218-0x0000000000400000-0x0000000000419000-memory.dmp

                                  Filesize

                                  100KB

                                  Download

                                • memory/2460-477-0x0000000000890000-0x0000000000C4B000-memory.dmp

                                  Filesize

                                  3.7MB

                                  Download

                                • memory/2460-644-0x0000000000890000-0x0000000000C4B000-memory.dmp

                                  Filesize

                                  3.7MB

                                  Download

                                • memory/2460-646-0x0000000000890000-0x0000000000C4B000-memory.dmp

                                  Filesize

                                  3.7MB

                                  Download

                                • memory/2588-153-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2588-151-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2588-157-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2588-204-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2588-104-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2636-0-0x00000000003C0000-0x00000000006E8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/2636-1-0x0000000077284000-0x0000000077286000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/2636-2-0x00000000003C1000-0x00000000003EF000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/2636-17-0x00000000003C0000-0x00000000006E8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/2636-3-0x00000000003C0000-0x00000000006E8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/2636-4-0x00000000003C0000-0x00000000006E8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/2888-152-0x00000000058C0000-0x000000000595C000-memory.dmp

                                  Filesize

                                  624KB

                                  Download

                                • memory/2888-150-0x0000000000B50000-0x0000000000E70000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/2888-241-0x0000000005A80000-0x0000000005BD6000-memory.dmp

                                  Filesize

                                  1.3MB

                                  Download

                                • memory/2888-277-0x00000000057A0000-0x00000000057C2000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/2888-274-0x0000000006180000-0x0000000006724000-memory.dmp

                                  Filesize

                                  5.6MB

                                  Download

                                • memory/3240-311-0x00000000007C0000-0x0000000000AE6000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/3240-304-0x00000000007C0000-0x0000000000AE6000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/3448-155-0x0000000000B40000-0x00000000016AE000-memory.dmp

                                  Filesize

                                  11.4MB

                                  Download

                                • memory/3448-216-0x0000000000B40000-0x00000000016AE000-memory.dmp

                                  Filesize

                                  11.4MB

                                  Download

                                • memory/3448-158-0x0000000000B40000-0x00000000016AE000-memory.dmp

                                  Filesize

                                  11.4MB

                                  Download

                                • memory/3448-154-0x0000000000B40000-0x00000000016AE000-memory.dmp

                                  Filesize

                                  11.4MB

                                  Download

                                • memory/3448-130-0x0000000000B40000-0x00000000016AE000-memory.dmp

                                  Filesize

                                  11.4MB

                                  Download

                                • memory/3508-65-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/3508-62-0x0000000000150000-0x000000000060A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3508-63-0x00000000050E0000-0x00000000054E0000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/3508-64-0x00000000050E0000-0x00000000054E0000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/3508-67-0x0000000075B70000-0x0000000075D85000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/3508-76-0x0000000000150000-0x000000000060A000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3616-4888-0x0000000000B10000-0x0000000000FB6000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/3724-109-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/3724-612-0x0000000000B40000-0x0000000000FEB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3724-554-0x0000000000B40000-0x0000000000FEB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3724-388-0x0000000000B40000-0x0000000000FEB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3724-114-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/3768-71-0x00007FFB47E10000-0x00007FFB48005000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/3768-73-0x0000000075B70000-0x0000000075D85000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/3768-68-0x0000000000740000-0x000000000074A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/3768-70-0x0000000001000000-0x0000000001400000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/4032-582-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/4032-511-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/4092-305-0x0000000073680000-0x0000000073691000-memory.dmp

                                  Filesize

                                  68KB

                                  Download

                                • memory/4092-240-0x000000006FBE0000-0x000000006FBFB000-memory.dmp

                                  Filesize

                                  108KB

                                  Download

                                • memory/4320-112-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/4320-580-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4320-510-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4320-110-0x00000000004E0000-0x00000000007F0000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/4324-430-0x0000000006840000-0x000000000688C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/4324-461-0x00000000079E0000-0x0000000007A83000-memory.dmp

                                  Filesize

                                  652KB

                                  Download

                                • memory/4324-466-0x0000000007DF0000-0x0000000007E04000-memory.dmp

                                  Filesize

                                  80KB

                                  Download

                                • memory/4324-463-0x0000000007C90000-0x0000000007CA1000-memory.dmp

                                  Filesize

                                  68KB

                                  Download

                                • memory/4324-428-0x0000000006290000-0x00000000065E4000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/4324-451-0x0000000070100000-0x000000007014C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/4436-406-0x0000000007510000-0x0000000007521000-memory.dmp

                                  Filesize

                                  68KB

                                  Download

                                • memory/4436-404-0x0000000007380000-0x000000000738A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/4436-355-0x0000000005170000-0x0000000005798000-memory.dmp

                                  Filesize

                                  6.2MB

                                  Download

                                • memory/4436-356-0x0000000005000000-0x0000000005022000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/4436-401-0x00000000071F0000-0x0000000007293000-memory.dmp

                                  Filesize

                                  652KB

                                  Download

                                • memory/4436-369-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/4436-357-0x0000000005910000-0x0000000005976000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/4436-400-0x00000000065A0000-0x00000000065BE000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/4436-403-0x0000000007310000-0x000000000732A000-memory.dmp

                                  Filesize

                                  104KB

                                  Download

                                • memory/4436-389-0x0000000006FB0000-0x0000000006FE2000-memory.dmp

                                  Filesize

                                  200KB

                                  Download

                                • memory/4436-363-0x00000000059F0000-0x0000000005A56000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/4436-370-0x0000000006010000-0x000000000605C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/4436-414-0x0000000007630000-0x0000000007638000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/4436-413-0x0000000007650000-0x000000000766A000-memory.dmp

                                  Filesize

                                  104KB

                                  Download

                                • memory/4436-412-0x0000000007550000-0x0000000007564000-memory.dmp

                                  Filesize

                                  80KB

                                  Download

                                • memory/4436-411-0x0000000007540000-0x000000000754E000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/4436-402-0x0000000007950000-0x0000000007FCA000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/4436-405-0x0000000007590000-0x0000000007626000-memory.dmp

                                  Filesize

                                  600KB

                                  Download

                                • memory/4436-368-0x0000000005B60000-0x0000000005EB4000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/4436-354-0x00000000026F0000-0x0000000002726000-memory.dmp

                                  Filesize

                                  216KB

                                  Download

                                • memory/4436-390-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/4532-42-0x0000000000EF0000-0x00000000013ED000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4532-37-0x0000000000EF0000-0x00000000013ED000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4532-39-0x0000000000EF0000-0x00000000013ED000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/4532-38-0x0000000000EF1000-0x0000000000F08000-memory.dmp

                                  Filesize

                                  92KB

                                  Download

                                • memory/4536-159-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-40-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-18-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-20-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-19-0x00000000006A1000-0x00000000006CF000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/4536-21-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-230-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-156-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-60-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-131-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4536-74-0x00000000006A0000-0x00000000009C8000-memory.dmp

                                  Filesize

                                  3.2MB

                                  Download

                                • memory/4824-705-0x0000000000400000-0x0000000000464000-memory.dmp

                                  Filesize

                                  400KB

                                  Download

                                • memory/4824-706-0x00000000057E0000-0x0000000005878000-memory.dmp

                                  Filesize

                                  608KB

                                  Download

                                • memory/4824-2780-0x0000000005990000-0x00000000059BC000-memory.dmp

                                  Filesize

                                  176KB

                                  Download

                                • memory/4824-2781-0x00000000059F0000-0x0000000005A3C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/4964-353-0x0000000000250000-0x000000000025C000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/5060-327-0x0000000000270000-0x0000000000716000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/5060-372-0x0000000000270000-0x0000000000716000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/5672-4892-0x0000000000C50000-0x00000000010FB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5672-4890-0x0000000000C50000-0x00000000010FB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5672-2787-0x0000000000C50000-0x00000000010FB000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5932-2807-0x0000000000400000-0x0000000000464000-memory.dmp

                                  Filesize

                                  400KB

                                  Download

                                • memory/5932-4874-0x00000000059A0000-0x00000000059CC000-memory.dmp

                                  Filesize

                                  176KB

                                  Download

                                • memory/5932-2808-0x0000000005870000-0x0000000005908000-memory.dmp

                                  Filesize

                                  608KB

                                  Download