Overview

overview

10

Static

static

3

e5b32ba4f7...7b.exe

windows7-x64

10

e5b32ba4f7...7b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 06:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe

  • Size

    2.9MB

  • MD5

    0f299dff09ef0812a445f45f955ce8b2

  • SHA1

    08479f8270aefa0c901f42131a8c805577689de1

  • SHA256

    e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b

  • SHA512

    2539b8d7516e5230e70aa20dcac3d712b38c6d7a13b923ae88ad8c52b20e70ae715f8f64232c4153486d943569eba6a2abff5e3ce6c21b25b3c5852544ebda04

  • SSDEEP

    49152:18GUOiFKP0FB56S2xmkHdcd7grPT/VL6Gx2NNmP3s:1p0FB56jx5c5gXNGG1P3s

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 34 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 38 IoCs
  • Identifies Wine through registry keys 2 TTPs 17 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe
        "C:\Users\Admin\AppData\Local\Temp\e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Users\Admin\AppData\Local\Temp\1007364001\7e5724b6c9.exe
            "C:\Users\Admin\AppData\Local\Temp\1007364001\7e5724b6c9.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1336
          • C:\Users\Admin\AppData\Local\Temp\1007365001\7dd41631c8.exe
            "C:\Users\Admin\AppData\Local\Temp\1007365001\7dd41631c8.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2020
          • C:\Users\Admin\AppData\Local\Temp\1007366001\ff805f0547.exe
            "C:\Users\Admin\AppData\Local\Temp\1007366001\ff805f0547.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:356
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2192
              • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:600
                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:844
              • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1724
                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:3688
                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3716
              • C:\Users\Admin\AppData\Local\Temp\1017376001\e267ea01c7.exe
                "C:\Users\Admin\AppData\Local\Temp\1017376001\e267ea01c7.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:2072
              • C:\Users\Admin\AppData\Local\Temp\1017379001\14010abd91.exe
                "C:\Users\Admin\AppData\Local\Temp\1017379001\14010abd91.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1876
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\djpkucor"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1792
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1628
              • C:\Users\Admin\AppData\Local\Temp\1017380001\57dcec7ba4.exe
                "C:\Users\Admin\AppData\Local\Temp\1017380001\57dcec7ba4.exe"
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2104
              • C:\Users\Admin\AppData\Local\Temp\1017381001\6a37b637f5.exe
                "C:\Users\Admin\AppData\Local\Temp\1017381001\6a37b637f5.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2028
                • C:\Users\Admin\AppData\Local\Temp\1017381001\6a37b637f5.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017381001\6a37b637f5.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  PID:2120
              • C:\Users\Admin\AppData\Local\Temp\1017382001\6a3180d24f.exe
                "C:\Users\Admin\AppData\Local\Temp\1017382001\6a3180d24f.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1328
              • C:\Users\Admin\AppData\Local\Temp\1017383001\c49343eff6.exe
                "C:\Users\Admin\AppData\Local\Temp\1017383001\c49343eff6.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4456
                • C:\Windows\system32\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                  7⤵
                  • Loads dropped DLL
                  PID:5804
                  • C:\Windows\system32\mode.com
                    mode 65,10
                    8⤵
                      PID:6084
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1264
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_7.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6288
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_6.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6444
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_5.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6676
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_4.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6812
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_3.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6980
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_2.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:7120
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_1.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2188
                    • C:\Windows\system32\attrib.exe
                      attrib +H "in.exe"
                      8⤵
                      • Views/modifies file attributes
                      PID:3972
                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                      "in.exe"
                      8⤵
                      • Executes dropped EXE
                      PID:564
                      • C:\Windows\system32\attrib.exe
                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        9⤵
                        • Views/modifies file attributes
                        PID:1576
                      • C:\Windows\system32\attrib.exe
                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        9⤵
                        • Views/modifies file attributes
                        PID:3164
                      • C:\Windows\system32\schtasks.exe
                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:3744
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.0.0.1; del in.exe
                        9⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3832
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                          10⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:4484
                • C:\Users\Admin\AppData\Local\Temp\1017384001\1c0262d528.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017384001\1c0262d528.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:3292
                  • C:\Users\Admin\AppData\Local\Temp\Z126GMZQLUV1L0753QA3.exe
                    "C:\Users\Admin\AppData\Local\Temp\Z126GMZQLUV1L0753QA3.exe"
                    7⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Windows security modification
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5524
                  • C:\Users\Admin\AppData\Local\Temp\VY8YNYJ9Z5NE0KC5X37DX.exe
                    "C:\Users\Admin\AppData\Local\Temp\VY8YNYJ9Z5NE0KC5X37DX.exe"
                    7⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:6520
                • C:\Users\Admin\AppData\Local\Temp\1017385001\4441cdc353.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017385001\4441cdc353.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:4720
                • C:\Users\Admin\AppData\Local\Temp\1017386001\b31595062e.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017386001\b31595062e.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:6240
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2044
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3532
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4148
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:7296
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:7396
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:7568
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:7604
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.0.602766424\90807394" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e103229-05f0-4613-bee1-8574acae03f5} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 1300 124d7958 gpu
                          9⤵
                            PID:4184
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.1.533650304\1558894696" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c775dd8e-3bc9-4e56-9472-baf6c81fde5a} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 1500 e74e58 socket
                            9⤵
                              PID:8392
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.2.351954153\336833066" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 2052 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92381930-cc16-4403-9d3b-6ff055c345cb} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 2068 1a9a2458 tab
                              9⤵
                                PID:9048
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.3.1633426984\1097586203" -childID 2 -isForBrowser -prefsHandle 2772 -prefMapHandle 2764 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc8ebae-4be2-4d0f-98fe-40ce5a5f63ab} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 2784 1bc62e58 tab
                                9⤵
                                  PID:9756
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.4.1641752911\643369985" -childID 3 -isForBrowser -prefsHandle 3712 -prefMapHandle 3708 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2fe761-3501-4bf1-b025-350572a9882f} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 3724 1f1f7658 tab
                                  9⤵
                                    PID:6120
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.5.819453972\808347765" -childID 4 -isForBrowser -prefsHandle 3816 -prefMapHandle 3820 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ddef9ba-3e0b-4631-93f4-ac9e28b868af} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 3724 21d1c258 tab
                                    9⤵
                                      PID:6604
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7604.6.1300739624\655508003" -childID 5 -isForBrowser -prefsHandle 4052 -prefMapHandle 4056 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56bb051e-5bab-4c09-b2c4-f68db22b971e} 7604 "\\.\pipe\gecko-crash-server-pipe.7604" 4040 21d1da58 tab
                                      9⤵
                                        PID:6840
                                • C:\Users\Admin\AppData\Local\Temp\1017387001\3c03164d1b.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017387001\3c03164d1b.exe"
                                  6⤵
                                  • Modifies Windows Defender Real-time Protection settings
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Windows security modification
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:8260
                                • C:\Users\Admin\AppData\Local\Temp\1017388001\75aa832c1a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017388001\75aa832c1a.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5388
                                  • C:\Users\Admin\AppData\Local\Temp\1017388001\75aa832c1a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1017388001\75aa832c1a.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:932
                                • C:\Users\Admin\AppData\Local\Temp\1017389001\4110db9dc8.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017389001\4110db9dc8.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:6132
                                • C:\Users\Admin\AppData\Local\Temp\1017390001\bd5f19a5d4.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017390001\bd5f19a5d4.exe"
                                  6⤵
                                  • Enumerates VirtualBox registry keys
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:7160
                            • C:\Users\Admin\AppData\Local\Temp\1007367001\59f4c23c7d.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007367001\59f4c23c7d.exe"
                              4⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2800
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:408
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2440
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {24817215-162A-4CDD-8928-748E94DAD7ED} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
                        1⤵
                        • Loads dropped DLL
                        PID:3388
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:3720
                          • C:\Windows\explorer.exe
                            explorer.exe
                            3⤵
                              PID:3848
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                              3⤵
                              • Drops file in System32 directory
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4440
                              • C:\Windows\system32\PING.EXE
                                "C:\Windows\system32\PING.EXE" 127.1.10.1
                                4⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:5264

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        4
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        7
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          31KB

                          MD5

                          da42dd5df6b420f9d969a265c9b39247

                          SHA1

                          50ab1f9feb3f67e0c6748985e2df27b4e0de642e

                          SHA256

                          dd5337374991bf1583aa9a7923af494596c221d2e1f1652195f98b19785dbdb0

                          SHA512

                          1edc8b6d12e4eaaa5ae903cb944df9795f7d20a2515ae492f1a37484b2682c63cf384b87e853ded929bb8179ae11a77838c306f007ee1198372191503c1c5cf3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007364001\7e5724b6c9.exe
                          Filesize

                          2.8MB

                          MD5

                          37bc9fc38023802a67c6b8902a8bd890

                          SHA1

                          a31726802dece6ee4d91dec9eab23b057bd00efe

                          SHA256

                          708e04b3f2d37c3cb32b2f88962676ba939525b124a757236ea3174b5b2eee74

                          SHA512

                          6443fe14f8e0b75d124c5fd070870bced30f339e4718c7ec2fa875284ef7e0d46945ba17a32517b13f4e814a33cdafeabcd114b579311c20e4b374243bf2fdc5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007365001\7dd41631c8.exe
                          Filesize

                          1.9MB

                          MD5

                          c29eb2d3c39a0a808f1910e0e222ac94

                          SHA1

                          7270457cd535c48825b4328b9124985e7bf95be1

                          SHA256

                          0f5afd165ede6d66b0a86c84b534afcf9ac51c46b43c023f632aa0bf4f087819

                          SHA512

                          4affdc6c38038f269a51144bb22ee844918ac708e85f1c152911b0d5b82241cde79f26fd366127a0cd7cc96ecb9ac88a8b0d90677162b6f5d5e87d68b666f118

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007366001\ff805f0547.exe
                          Filesize

                          2.8MB

                          MD5

                          8d64f1d7ace873c2aa994c6b8ded6ae7

                          SHA1

                          b1fcba92c6a6180211b8e3dcd54acf041cd0fc44

                          SHA256

                          4355db0995121456108e7d7630b8400f8fa6546576cdfdde15fb2a69fa616044

                          SHA512

                          1e9913350667af65e81798187d81164d2057a910982d3fce42bde56b41c19a1c83fb6951778a04ccb670e6c73370a52867ef6321784fc0b67bff78061e8707ab

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007367001\59f4c23c7d.exe
                          Filesize

                          4.3MB

                          MD5

                          8cd346fc831e7d59ebab0de045018b84

                          SHA1

                          65ecbe74b5e512c9b00dbb0d041ac1f812f3cbb5

                          SHA256

                          ca2b0a34c077e6e81cde2626da1aca4de3f52190747d4f66636a0a8397e158c5

                          SHA512

                          6708a808b9300845e5852f25a380abf1ce807d96695256793c7a80ebc08307f21a6ba38bc0d73c2897c46ad2828f80717ad2f79c585c658324c7b887bf797912

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                          Filesize

                          1.1MB

                          MD5

                          ef08a45833a7d881c90ded1952f96cb4

                          SHA1

                          f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                          SHA256

                          33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                          SHA512

                          74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                          Filesize

                          1.1MB

                          MD5

                          68c0e4eefd4c6a76cff542ef57a49ca2

                          SHA1

                          8aa521628b89f3ce539269229834da2a87060e76

                          SHA256

                          4e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83

                          SHA512

                          d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017376001\e267ea01c7.exe
                          Filesize

                          1.8MB

                          MD5

                          25fb9c54265bbacc7a055174479f0b70

                          SHA1

                          4af069a2ec874703a7e29023d23a1ada491b584e

                          SHA256

                          552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                          SHA512

                          7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017379001\14010abd91.exe
                          Filesize

                          21KB

                          MD5

                          14becdf1e2402e9aa6c2be0e6167041e

                          SHA1

                          72cbbae6878f5e06060a0038b25ede93b445f0df

                          SHA256

                          7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                          SHA512

                          16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017381001\6a37b637f5.exe
                          Filesize

                          747KB

                          MD5

                          8a9cb17c0224a01bd34b46495983c50a

                          SHA1

                          00296ea6a56f6e10a0f1450a20c5fb329b8856c1

                          SHA256

                          3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

                          SHA512

                          1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017383001\c49343eff6.exe
                          Filesize

                          4.2MB

                          MD5

                          3a425626cbd40345f5b8dddd6b2b9efa

                          SHA1

                          7b50e108e293e54c15dce816552356f424eea97a

                          SHA256

                          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                          SHA512

                          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017384001\1c0262d528.exe
                          Filesize

                          1.8MB

                          MD5

                          75a3f7dd4f1946ba3b6908c11fc97b60

                          SHA1

                          0ca7014bffadc5f05553366c0407540cabbf940c

                          SHA256

                          1a0c403a7f94e7e1592cd2568b66f9dd23efa77b7dd8b783200d226a8d0c0e10

                          SHA512

                          f4bb1713c33c78bbc7e9a4b9173e1327adc325b3da7ebdcdcf05b192f93c68c493b2fbb8ba5f8a78430261afc915461a40dfe2ce90a70904193643157a8109f4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017386001\b31595062e.exe
                          Filesize

                          950KB

                          MD5

                          945996569823aeef595820a5fb2e6990

                          SHA1

                          9ecabc7eba594b4e53b5e9469f2ea0ce104d30b0

                          SHA256

                          3c7f4833371953bed399f88946ce57a08cf2615425983df595bcbcec1dc1f5db

                          SHA512

                          8d0fe62b284de59d5414a9943ad97a5a32adf44847e4eb48882783dc52c1e48ccf51654981529d17e41cb45bb8f1c81d2f8bfa29dfc3b070f487b5cb41cf4d92

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017387001\3c03164d1b.exe
                          Filesize

                          1.7MB

                          MD5

                          2d0d6335887bc79a41c06f85a76e0011

                          SHA1

                          68c7848a94ede332ce9b8fc01d79e6e2f9e9c5da

                          SHA256

                          e29954c79b53a37b023e3474653eebf343493976e920cb8adecda16027fbdbc5

                          SHA512

                          30e265316867df8da75088e3d933d61e513ce2754a1da2565dea7791dd0b349b70c6e16b3331940bc0277369a1db303794101cc7cbbfd4cbc2ca8d916407921b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017388001\75aa832c1a.exe
                          Filesize

                          3.1MB

                          MD5

                          c00a67d527ef38dc6f49d0ad7f13b393

                          SHA1

                          7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                          SHA256

                          12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                          SHA512

                          9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017389001\4110db9dc8.exe
                          Filesize

                          1.8MB

                          MD5

                          ff279f4e5b1c6fbda804d2437c2dbdc8

                          SHA1

                          2feb3762c877a5ae3ca60eeebc37003ad0844245

                          SHA256

                          e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                          SHA512

                          c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017390001\bd5f19a5d4.exe
                          Filesize

                          4.2MB

                          MD5

                          899d588f2750275f89657f3331e56c5d

                          SHA1

                          90282eec54f7d4068114d5e4a5ac42957d1babff

                          SHA256

                          46b7885c9b1863d30a35105d3284c460bda9904f0deaa2705371927c4a3084bf

                          SHA512

                          01e169a484f198aece35fe242abe1c750cd5075885c49eca561ee63db7a9edc00a902795c124d377d67e627f56535da90ebe5cc3bf9d1d2f3483424fe3ec2acf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CabD30A.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TarD3E7.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                          Filesize

                          1.6MB

                          MD5

                          72491c7b87a7c2dd350b727444f13bb4

                          SHA1

                          1e9338d56db7ded386878eab7bb44b8934ab1bc7

                          SHA256

                          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                          SHA512

                          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          Filesize

                          458KB

                          MD5

                          619f7135621b50fd1900ff24aade1524

                          SHA1

                          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                          SHA256

                          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                          SHA512

                          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                          Filesize

                          3.3MB

                          MD5

                          045b0a3d5be6f10ddf19ae6d92dfdd70

                          SHA1

                          0387715b6681d7097d372cd0005b664f76c933c7

                          SHA256

                          94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                          SHA512

                          58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                          Filesize

                          440B

                          MD5

                          3626532127e3066df98e34c3d56a1869

                          SHA1

                          5fa7102f02615afde4efd4ed091744e842c63f78

                          SHA256

                          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                          SHA512

                          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                          Filesize

                          7KB

                          MD5

                          04ae738ccfd198e8040131e4bbf8edd0

                          SHA1

                          04a6dc750df0330f542c3d87c0a098990824b72c

                          SHA256

                          3770ae22fbb383cb7609bcb6b686575e78cd99bd9a2bf4c1defdf5e0c2cc494d

                          SHA512

                          a55ba7bdb19aa5c5936901778be35f53de0df292d2693bdab69eb569bccdc0ea36c430a90e9858456c876b7ead1a7d32fe672aab5c012d8064456bdc067ae424

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          699fe636556ef7eb544ead163c6d5dbb

                          SHA1

                          16c6c267a65d938c4dac78aae0a79e973984a24a

                          SHA256

                          469084d1dbb256185ab399cd9827476cede7e1ef047a8dba88d5131a734a4281

                          SHA512

                          e5b7abea9509331f28ef99c7c8635574f83338c32c8ec51c0ddb5a7def9e58f464effe451e1ab4f85092c3770d20ed6467c1ded73c5b0ec5f841fab4ee44da3c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\aae36300-a34a-443d-b428-28cb760706ae
                          Filesize

                          745B

                          MD5

                          c7d2c2a706925e9fe9c69b454c7e118b

                          SHA1

                          de9d3da564401660bf3a69262219058d20fe8bda

                          SHA256

                          9fee2218215b86ce015ecb9966f83b43b672c65d3077f903f98457dd7ed2ff3c

                          SHA512

                          5d18967f4ff6b492174a3fe2e31ea13516260ece292ebf3f2f0b7d10097e9fd69b39241d7ffd2677a32654a148512fe14e4544f49ae4c932ebdc3c0163ffcffc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\fa4cc1b2-74b7-41ad-9c2c-78ef31f2b1cf
                          Filesize

                          11KB

                          MD5

                          56afb85798bb8fa669dc68dcfdb37109

                          SHA1

                          81c7951e839e7898ee71f40dee7a9adc5f090d3b

                          SHA256

                          0e4a1de439068acad1bc5f253c725605db40f8895b1558bbb310fe2bf27989cc

                          SHA512

                          1ee5797ca9ae2472a3583627fdecdef33882b70c439f1f1247d574ae5e0f4fbc829385cefa3ca994a52001d7d103a96fd29298ac71f2ea30401885c050f6617c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          50873bc410a691f066f1a99629079e44

                          SHA1

                          ab7ae95fdf39475046b952d1859adb2ddfb3b59b

                          SHA256

                          797e265176be31bf90e45ac7d044fb4445f2d5e16ef64c54823029550496b787

                          SHA512

                          cae3764a52e54e0148f550223c9afd06f44eebd57ad075bcacd8578ff434ef1fb66a849096ffee1da858ebd13bbc9df956bd414f15e0661e283b99b3db41d383

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          e4b3205888588b310488849a259a7bd6

                          SHA1

                          d7746465b4255d09ff3f31702b51ee943c70bb27

                          SHA256

                          f0313a4556a1c098305db7bd5e74c255dfbc9e89d3e56e7670c027e6598cc447

                          SHA512

                          4b24ba8be53d4f631ca510a358216d9edee650e1d3a0a8a928bbc9634b8884c0db43afc21edc7a3cc50a34bd75d96d822d4552014b1f73861c14fbdba6c63418

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          9f361805169f368aacc106bb1b16daff

                          SHA1

                          dca3be329c56143a9ae05d10c38e5194bc1eaf37

                          SHA256

                          1728d6d5f6d34f5d69044946d51d516702f4299d5843fc6ed94fd0c8bdc515fe

                          SHA512

                          e36476a39a42bcc4a7940af7cef935c915d1977b9576ed34a9b3c6a7e29f35e74dd86f6668e7f0d6fd2d3e9b74ee4ed3058e244bb96f314a994b40b4104ff2aa

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          8361eada375d27abed9b614374b8bac1

                          SHA1

                          686ffcf95f4bd41766d3aec927794ee589b7a1c9

                          SHA256

                          e0874bffa616e5f92d8eaa862e3fb25313e425d61ee97f33988a4fd2f1964926

                          SHA512

                          0b5e6bef4b6b7a06199893e84635e896a934fa7f138939da46401aaa69c50a9e0e01246c6c179f33fa1ff7e4098108c41e23a2459dba7c6f01877d537da26218

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                          Filesize

                          2.9MB

                          MD5

                          0f299dff09ef0812a445f45f955ce8b2

                          SHA1

                          08479f8270aefa0c901f42131a8c805577689de1

                          SHA256

                          e5b32ba4f7b2f54f95d3856220aa252c6122116e16916133d20a9f38ca9e4c7b

                          SHA512

                          2539b8d7516e5230e70aa20dcac3d712b38c6d7a13b923ae88ad8c52b20e70ae715f8f64232c4153486d943569eba6a2abff5e3ce6c21b25b3c5852544ebda04

                          Download Submit

                        • memory/356-113-0x0000000006B70000-0x0000000006E80000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/356-112-0x00000000009E0000-0x0000000000CF0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/356-99-0x00000000009E0000-0x0000000000CF0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/356-134-0x0000000006B70000-0x0000000006E80000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/408-76-0x0000000000080000-0x000000000008A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/408-94-0x00000000777B0000-0x0000000077959000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/408-96-0x00000000770F0000-0x0000000077137000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/408-89-0x00000000008A0000-0x0000000000CA0000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/600-300-0x0000000004A60000-0x0000000004B22000-memory.dmp

                          Filesize

                          776KB

                          Download

                        • memory/600-166-0x0000000000370000-0x0000000000396000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/600-165-0x0000000001050000-0x0000000001166000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/844-359-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/844-358-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/844-4522-0x0000000000470000-0x000000000049C000-memory.dmp

                          Filesize

                          176KB

                          Download

                        • memory/844-353-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/844-355-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/844-365-0x0000000000C70000-0x0000000000D08000-memory.dmp

                          Filesize

                          608KB

                          Download

                        • memory/844-364-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/844-4524-0x0000000000700000-0x000000000074C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/844-351-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/1336-45-0x00000000009F0000-0x0000000000EED000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/1336-48-0x00000000009F0000-0x0000000000EED000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/1724-334-0x0000000005B90000-0x0000000005C50000-memory.dmp

                          Filesize

                          768KB

                          Download

                        • memory/1724-185-0x00000000000F0000-0x0000000000202000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/1724-186-0x0000000000340000-0x0000000000366000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/1876-222-0x0000000000E70000-0x0000000000E7C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2020-74-0x00000000770F0000-0x0000000077137000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/2020-72-0x00000000777B0000-0x0000000077959000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2020-70-0x0000000004BD0000-0x0000000004FD0000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2020-71-0x0000000004BD0000-0x0000000004FD0000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2020-78-0x0000000000120000-0x00000000005DA000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2020-68-0x0000000000120000-0x00000000005DA000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2072-206-0x0000000000820000-0x0000000000CCB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2072-335-0x0000000000820000-0x0000000000CCB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2072-299-0x0000000000820000-0x0000000000CCB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2072-333-0x0000000000820000-0x0000000000CCB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2104-259-0x0000000004E50000-0x0000000005250000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2104-266-0x0000000000B10000-0x0000000000FCA000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2104-262-0x00000000770F0000-0x0000000077137000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/2104-260-0x00000000777B0000-0x0000000077959000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2120-329-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2120-319-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-332-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-330-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-324-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-327-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-325-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2120-321-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/2192-114-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-146-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-135-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-136-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-142-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-349-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-245-0x00000000067E0000-0x0000000006C8B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-241-0x00000000067E0000-0x0000000006C9A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-242-0x00000000067E0000-0x0000000006C8B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-240-0x00000000067E0000-0x0000000006C9A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-223-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-205-0x00000000067E0000-0x0000000006C8B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-203-0x00000000067E0000-0x0000000006C8B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2192-144-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2192-167-0x0000000000DF0000-0x0000000001100000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2424-3-0x0000000000090000-0x00000000003B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2424-0-0x0000000000090000-0x00000000003B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2424-4-0x0000000000090000-0x00000000003B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2424-2-0x0000000000091000-0x00000000000BF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2424-9-0x0000000000090000-0x00000000003B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2424-1-0x00000000779A0000-0x00000000779A2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2424-19-0x0000000000090000-0x00000000003B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2424-20-0x0000000006C10000-0x0000000006F38000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2440-264-0x0000000000080000-0x000000000008A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2440-295-0x00000000777B0000-0x0000000077959000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2440-297-0x00000000770F0000-0x0000000077137000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/2440-267-0x0000000002170000-0x0000000002570000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2800-141-0x0000000000900000-0x000000000146E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2800-138-0x0000000000900000-0x000000000146E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2800-140-0x0000000000900000-0x000000000146E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2800-131-0x0000000000900000-0x000000000146E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2940-130-0x00000000064C0000-0x000000000702E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2940-139-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-132-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-298-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-187-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-115-0x00000000064C0000-0x000000000697A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2940-147-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-145-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-143-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-97-0x00000000064C0000-0x00000000069BD000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2940-100-0x00000000064C0000-0x00000000069BD000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2940-98-0x00000000064C0000-0x00000000067D0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2940-69-0x00000000064C0000-0x000000000697A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2940-67-0x00000000064C0000-0x000000000697A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2940-50-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-49-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-44-0x00000000064C0000-0x00000000069BD000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2940-133-0x00000000064C0000-0x00000000067D0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2940-21-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-46-0x00000000064C0000-0x00000000069BD000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2940-137-0x00000000064C0000-0x000000000702E000-memory.dmp

                          Filesize

                          11.4MB

                          Download

                        • memory/2940-22-0x0000000000161000-0x000000000018F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2940-23-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-47-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-43-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-26-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2940-24-0x0000000000160000-0x0000000000488000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/3716-2446-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/3716-4523-0x00000000007C0000-0x00000000007EC000-memory.dmp

                          Filesize

                          176KB

                          Download

                        • memory/3716-2447-0x0000000004680000-0x0000000004718000-memory.dmp

                          Filesize

                          608KB

                          Download

                        • memory/3832-4586-0x0000000001E80000-0x0000000001E88000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/3832-4585-0x000000001B740000-0x000000001BA22000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/4440-4993-0x000000001B650000-0x000000001B932000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/4440-4994-0x0000000001F70000-0x0000000001F78000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/5388-4811-0x0000000001090000-0x00000000013B8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/5388-4963-0x0000000004E50000-0x0000000004FA6000-memory.dmp

                          Filesize

                          1.3MB

                          Download

                        • memory/5388-4964-0x0000000000430000-0x0000000000452000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/5524-4821-0x0000000000190000-0x00000000005F2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/5524-4820-0x0000000000190000-0x00000000005F2000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/8260-4778-0x00000000011D0000-0x0000000001632000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/8260-4779-0x00000000011D0000-0x0000000001632000-memory.dmp

                          Filesize

                          4.4MB

                          Download