Overview

overview

10

Static

static

3

df0ab8c25c...7N.exe

windows7-x64

10

df0ab8c25c...7N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 09:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df0ab8c25c9c723d7cf4fe65c9ff62691d49df07779b6e5c0da6eeae1f1a1617N.exe

  • Size

    2.9MB

  • MD5

    11e1f1eb5c83019001fef14fa3ce6af0

  • SHA1

    f23f5abde50d73221d6d76243a15ba77e73dd5b8

  • SHA256

    df0ab8c25c9c723d7cf4fe65c9ff62691d49df07779b6e5c0da6eeae1f1a1617

  • SHA512

    99f0d256a1ce568350bfbdf5b96f724aa1e0a697f94edc529c9956364342337783dc09cf9a173f0e28fb5757d28985ea7dd67f73b2775dbbf7164c051e789fc7

  • SSDEEP

    49152:qfKA49/TqhlO+8ptCANYJc1eqP/w0JEKor3Ne:qfK1/TqjOFLYJc19P/Hng

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 32 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 40 IoCs
  • Identifies Wine through registry keys 2 TTPs 16 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\df0ab8c25c9c723d7cf4fe65c9ff62691d49df07779b6e5c0da6eeae1f1a1617N.exe
        "C:\Users\Admin\AppData\Local\Temp\df0ab8c25c9c723d7cf4fe65c9ff62691d49df07779b6e5c0da6eeae1f1a1617N.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
            "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1220
            • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
              "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2904
          • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
            "C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1984
            • C:\Users\Admin\AppData\Local\Temp\onefile_1984_133790741060146000\trunk.exe
              C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1516
          • C:\Users\Admin\AppData\Local\Temp\1007396001\e07e6aa442.exe
            "C:\Users\Admin\AppData\Local\Temp\1007396001\e07e6aa442.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1964
          • C:\Users\Admin\AppData\Local\Temp\1007397001\6fca632c16.exe
            "C:\Users\Admin\AppData\Local\Temp\1007397001\6fca632c16.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1132
          • C:\Users\Admin\AppData\Local\Temp\1007398001\cdeb3e6f69.exe
            "C:\Users\Admin\AppData\Local\Temp\1007398001\cdeb3e6f69.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2332
              • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2528
                • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                  "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:952
              • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
                6⤵
                • Executes dropped EXE
                PID:1656
              • C:\Users\Admin\AppData\Local\Temp\1016974001\3cf5d65705.exe
                "C:\Users\Admin\AppData\Local\Temp\1016974001\3cf5d65705.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2764
              • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1688
              • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1180
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\envltaxak"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1964
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2280
              • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2096
              • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2028
                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1048
              • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1044
                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4104
              • C:\Users\Admin\AppData\Local\Temp\1017488001\93a09a5172.exe
                "C:\Users\Admin\AppData\Local\Temp\1017488001\93a09a5172.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2036
                • C:\Users\Admin\AppData\Local\Temp\1017488001\93a09a5172.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017488001\93a09a5172.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:928
              • C:\Users\Admin\AppData\Local\Temp\1017489001\ed8ddbf1a9.exe
                "C:\Users\Admin\AppData\Local\Temp\1017489001\ed8ddbf1a9.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1076
              • C:\Users\Admin\AppData\Local\Temp\1017490001\f99e8284a7.exe
                "C:\Users\Admin\AppData\Local\Temp\1017490001\f99e8284a7.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:276
              • C:\Users\Admin\AppData\Local\Temp\1017491001\2398dee191.exe
                "C:\Users\Admin\AppData\Local\Temp\1017491001\2398dee191.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2292
              • C:\Users\Admin\AppData\Local\Temp\1017492001\861335b466.exe
                "C:\Users\Admin\AppData\Local\Temp\1017492001\861335b466.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1528
              • C:\Users\Admin\AppData\Local\Temp\1017493001\2c433ec2e9.exe
                "C:\Users\Admin\AppData\Local\Temp\1017493001\2c433ec2e9.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:10232
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10696
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10772
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10820
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10864
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10908
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:10952
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:10960
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.0.2137404458\497961454" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84c4ad25-c987-41e1-b03a-862d2b662f1e} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 1300 115e9b58 gpu
                        9⤵
                          PID:11192
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.1.1542920433\1134168390" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb4752cf-bbff-4bb9-9c53-6682a4cca891} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 1504 d73358 socket
                          9⤵
                            PID:3060
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.2.1887875960\1605141412" -childID 1 -isForBrowser -prefsHandle 1812 -prefMapHandle 2028 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 812 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f74b7d4-348b-4c9b-84e7-4c9c352ddd17} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 2092 1afb7c58 tab
                            9⤵
                              PID:5432
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.3.16663884\1504379770" -childID 2 -isForBrowser -prefsHandle 2836 -prefMapHandle 2832 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 812 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0141941f-b9fa-45c4-bf93-4e6f430be10c} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 2848 d5d258 tab
                              9⤵
                                PID:6592
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.4.1879452495\982145454" -childID 3 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 812 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5d5a1f4-3e76-4ebc-a2e2-fca78ed68cc7} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 3780 d6bf58 tab
                                9⤵
                                  PID:8460
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.5.1448461050\505540329" -childID 4 -isForBrowser -prefsHandle 3888 -prefMapHandle 3892 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 812 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d02ea474-8241-41cc-bea8-a67ad011ae1e} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 3876 207b7f58 tab
                                  9⤵
                                    PID:9072
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="10960.6.648390501\2110328776" -childID 5 -isForBrowser -prefsHandle 4052 -prefMapHandle 4056 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 812 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db8f885d-599c-497e-ba79-eb5e2324831f} 10960 "\\.\pipe\gecko-crash-server-pipe.10960" 4040 1e3d1558 tab
                                    9⤵
                                      PID:3536
                              • C:\Users\Admin\AppData\Local\Temp\1017494001\e8e9cf94d7.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017494001\e8e9cf94d7.exe"
                                6⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:11132
                              • C:\Users\Admin\AppData\Local\Temp\1017495001\3d80e47bab.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017495001\3d80e47bab.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5192
                                • C:\Windows\system32\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                  7⤵
                                  • Loads dropped DLL
                                  PID:5648
                                  • C:\Windows\system32\mode.com
                                    mode 65,10
                                    8⤵
                                      PID:5740
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5768
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_7.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5856
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_6.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5972
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_5.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6060
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_4.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6160
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_3.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6256
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_2.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6352
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_1.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6460
                                    • C:\Windows\system32\attrib.exe
                                      attrib +H "in.exe"
                                      8⤵
                                      • Views/modifies file attributes
                                      PID:6548
                                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                      "in.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:6576
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        9⤵
                                        • Views/modifies file attributes
                                        PID:6636
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        9⤵
                                        • Views/modifies file attributes
                                        PID:6664
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                        9⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:6756
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell ping 127.0.0.1; del in.exe
                                        9⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6780
                                        • C:\Windows\system32\PING.EXE
                                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                                          10⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:7216
                                • C:\Users\Admin\AppData\Local\Temp\1017496001\60490ca969.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017496001\60490ca969.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:7460
                            • C:\Users\Admin\AppData\Local\Temp\1007399001\dbf6bf9d1d.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007399001\dbf6bf9d1d.exe"
                              4⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2096
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:352

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      7
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
                        Filesize

                        28KB

                        MD5

                        285552718daa4bbe11b66bed786e357f

                        SHA1

                        c061048bec22651826eaef248709c7503c19c7c4

                        SHA256

                        47e06007be39e82c136aa5531c07410ca2a0b33cab938a0a0a6631124f5f26af

                        SHA512

                        2097414e2bba4c66dc8d269fc2d0e0926747705ae9d98fadadd4aaba313a22d4623cadb4f3aee23ee2ab38e459588ffe5c1dc5dacc1a3a59b837e9916511ab08

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                        Filesize

                        2.5MB

                        MD5

                        7ff947867bc70055adffa2164a741b01

                        SHA1

                        cff424168c2f6bcef107ebc9bd65590f3ead76ae

                        SHA256

                        b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40

                        SHA512

                        da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                        Filesize

                        10.2MB

                        MD5

                        d3b39a6b63c3822be6f8af9b3813bbad

                        SHA1

                        00b020e5a1c05442612f2cec7950c2814b59b1b6

                        SHA256

                        786f1331a0618485b31ba763911b14fcec691bf9897bee8f42680076092b7a2f

                        SHA512

                        a5c7504b29798fdabf610cf65716ec1d7745956f470d86de12a52b3c8731f858764fdf78647e50b3111622e7e65f05f82cd258b98c1a0f45ef7fdc088647d4ff

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007396001\e07e6aa442.exe
                        Filesize

                        2.8MB

                        MD5

                        5081ea72759ba0dea91a56403ff62dc6

                        SHA1

                        40bddae611127beeb297e9bf3e865af47b8ed4e7

                        SHA256

                        7f7e285c14ba16177fac9340654eba93f5bcddd100dc2c7259afc2ad4cd19d88

                        SHA512

                        671425d2017542f7a4aabc339c9ec46180aec25a4ef00915d3851bcae43024e944ecce5b226ee5bbfe108a6da6301a027050df4748e3a01f1bbe9dc15cf03b2f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007397001\6fca632c16.exe
                        Filesize

                        1.9MB

                        MD5

                        27fee9f59528fe47fa6b7c0a81e24f7d

                        SHA1

                        226a9ea05b200a4eca2db8f4d2722678c26252e8

                        SHA256

                        641935a9640a37c5d213d1cdd51186a4536b63d1692b0492e8669cef646d1011

                        SHA512

                        61b8d79f2cadf042d8be73e40b7edfb584a2ec91d04315f37d697237bffd734b18becfe97eff2619ffd0aeae84df1ff7ff9c9853227e019f6fd51d6b8d93b3b0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007398001\cdeb3e6f69.exe
                        Filesize

                        2.9MB

                        MD5

                        7944ebe231d464c760a818b34a636cce

                        SHA1

                        52bdb9427bd7e9d2e2a75bcf5fc76e0e7819a73b

                        SHA256

                        c478f40cfe686bdc076d898a735f2857316a64d8e2d9dc405dde3e0ca8194b7f

                        SHA512

                        6435a4f51a6fce88eaf551ca452408fea62d437eb2297a0f6cc2aec94f51813e0c9370744b212217ab4e76016adf892c2d42fb0e6a9d6c8fb3f64c74af9351d7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007399001\dbf6bf9d1d.exe
                        Filesize

                        4.3MB

                        MD5

                        2ed56e48acd3d32e3d047b42b18103aa

                        SHA1

                        7f3a1c7ac09fb36680a29b5d964afabf5566dd02

                        SHA256

                        f7c192eeb6246cd1b3e3772b80057f6f74e1be940d3a7ded223b165589b9f154

                        SHA512

                        53d40e9a17c0ee95d9c2daa5d2df1e831dda9c291402edf90964e558c002abe6801630971797149a571e50dd25043f8b5236d653f4ad83d12a78c82453ecfed2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                        Filesize

                        3.1MB

                        MD5

                        f9b9f98592292b5cbf59c7a60e9ebaee

                        SHA1

                        59cc872fd0a11b259cc5b70893f35e9b5a7c8cbb

                        SHA256

                        5688e9e0becc622c573af2a1af4ee0676ef3907e38a9258a7801b46b7ad64665

                        SHA512

                        f27e4a96173aeb064f47d44ff445b1e15f6d4f39a4ad711c019bb29692caea56eb910970d22bc13ac5c57a256d71e77b12aa60c8405335a239781c57cb0eaf8e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                        Filesize

                        17.6MB

                        MD5

                        3c224e3fc892719dc1e302378e533579

                        SHA1

                        0a65062e1426a95bfeca355398b6fdc4912fb6b1

                        SHA256

                        64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

                        SHA512

                        554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1016974001\3cf5d65705.exe
                        Filesize

                        2.9MB

                        MD5

                        0ea56ef12b9744f2de996a4b5622ff2f

                        SHA1

                        04f077d018e0ca265700cc518914f363e45826cf

                        SHA256

                        59a4d6b267be8b643d44576c4659c2cd43ec388d85eac6c1284b78ac8298e567

                        SHA512

                        5e837869dc06518b18970135bbebf7125c68b6a33c88666fa8b3bd20be69b6c5097b6f676719b34eaad16f46db211e5e329f685298db3b5929eef0a3889128d9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                        Filesize

                        1.8MB

                        MD5

                        ff279f4e5b1c6fbda804d2437c2dbdc8

                        SHA1

                        2feb3762c877a5ae3ca60eeebc37003ad0844245

                        SHA256

                        e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                        SHA512

                        c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                        Filesize

                        21KB

                        MD5

                        14becdf1e2402e9aa6c2be0e6167041e

                        SHA1

                        72cbbae6878f5e06060a0038b25ede93b445f0df

                        SHA256

                        7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                        SHA512

                        16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                        Filesize

                        1.8MB

                        MD5

                        25fb9c54265bbacc7a055174479f0b70

                        SHA1

                        4af069a2ec874703a7e29023d23a1ada491b584e

                        SHA256

                        552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                        SHA512

                        7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                        Filesize

                        1.1MB

                        MD5

                        ef08a45833a7d881c90ded1952f96cb4

                        SHA1

                        f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                        SHA256

                        33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                        SHA512

                        74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                        Filesize

                        1.1MB

                        MD5

                        68c0e4eefd4c6a76cff542ef57a49ca2

                        SHA1

                        8aa521628b89f3ce539269229834da2a87060e76

                        SHA256

                        4e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83

                        SHA512

                        d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017488001\93a09a5172.exe
                        Filesize

                        758KB

                        MD5

                        afd936e441bf5cbdb858e96833cc6ed3

                        SHA1

                        3491edd8c7caf9ae169e21fb58bccd29d95aefef

                        SHA256

                        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                        SHA512

                        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017491001\2398dee191.exe
                        Filesize

                        1.7MB

                        MD5

                        8e89923efbac42f80f4e7fc0dc7aae45

                        SHA1

                        81667219cfb7e2d36d72faa07ff10315e451fbd5

                        SHA256

                        5049cb5f3b6dd8fe8dbc93d3d1abe40c32f69136447f934c65e4f29d3432a922

                        SHA512

                        d6e57a2b3daf422985b2fbca5e0062013662b9e9ad8a66854e626efe2315fb6a6812ab02a95967d61fd5bdbaa9351c97a85a54640e8e813cb6985d2d614cd5cf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017493001\2c433ec2e9.exe
                        Filesize

                        945KB

                        MD5

                        2252bd7350c2fe134502098fffd3fe0e

                        SHA1

                        cac34836fb85e204b1c339ee1e8e40443c03386a

                        SHA256

                        5d0c43f6d6c41bfe8231be3c771cc1f4b1018e7ccd25aa5bf96f371347318e6a

                        SHA512

                        617ad60959767d481733f0a80709e863648fd4e1c64198625db0bca94f002d48e2b2c2ab145384f349e6d12f045006f0130f7acf1c583b89c6d69465dc638a6c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017494001\e8e9cf94d7.exe
                        Filesize

                        1.7MB

                        MD5

                        80c7f6ba56476f282f1eb23421522f83

                        SHA1

                        325816fc1e9a95a090caf1b1aab58599c735e68f

                        SHA256

                        5ececd92978f414895b062a77afaf279d45746a7fa6a341a38ff9358958bd2ac

                        SHA512

                        acb03c8e6a7f450d1238564c93b3fb8f76e6a0622e09777fd55194b06ff409feba480495b893fe44de6299ea4ae734c114e0caa2cac9050cc08087d0d2a4bb30

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017495001\3d80e47bab.exe
                        Filesize

                        4.2MB

                        MD5

                        3a425626cbd40345f5b8dddd6b2b9efa

                        SHA1

                        7b50e108e293e54c15dce816552356f424eea97a

                        SHA256

                        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                        SHA512

                        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        Filesize

                        2.9MB

                        MD5

                        11e1f1eb5c83019001fef14fa3ce6af0

                        SHA1

                        f23f5abde50d73221d6d76243a15ba77e73dd5b8

                        SHA256

                        df0ab8c25c9c723d7cf4fe65c9ff62691d49df07779b6e5c0da6eeae1f1a1617

                        SHA512

                        99f0d256a1ce568350bfbdf5b96f724aa1e0a697f94edc529c9956364342337783dc09cf9a173f0e28fb5757d28985ea7dd67f73b2775dbbf7164c051e789fc7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        Filesize

                        458KB

                        MD5

                        619f7135621b50fd1900ff24aade1524

                        SHA1

                        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                        SHA256

                        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                        SHA512

                        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                        Filesize

                        440B

                        MD5

                        3626532127e3066df98e34c3d56a1869

                        SHA1

                        5fa7102f02615afde4efd4ed091744e842c63f78

                        SHA256

                        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                        SHA512

                        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\onefile_1984_133790741060146000\python312.dll
                        Filesize

                        6.6MB

                        MD5

                        166cc2f997cba5fc011820e6b46e8ea7

                        SHA1

                        d6179213afea084f02566ea190202c752286ca1f

                        SHA256

                        c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                        SHA512

                        49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                        Filesize

                        7KB

                        MD5

                        fc2c0cdcc8264fb737ddb0fbf01585d6

                        SHA1

                        1537b5360ce984a2bc79a7acdc80295f6387b4bc

                        SHA256

                        371ecd0a188febc7153a0dc029026f9c67c1808636a35cd9b474517a48f1b74a

                        SHA512

                        910217c7acdce9c7ac96aedcc496731ff52146c5d476b4e74a02d1f2c07c927e3b81d807a8830a324e47b58d92ebffa19d6246f3c9c37e2ecd569eb1787f4b9c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        2KB

                        MD5

                        ad225f29e7dcfb101b8430c327e9be5a

                        SHA1

                        52e60eab5d43468dd6ee1cb4038afab8423a44dc

                        SHA256

                        2ed73d0229521e9a43c89acc990159ccb3b1b12b74f2e8089f799445ce8a3314

                        SHA512

                        4e0affeffa1b0862541694d01ea20aec04cc5b3e73f5ba64b3ac5ae66bce4f0cc7cc6ed9dac58c6d651ac3dbbfe9171780237c946a63e34d6357bcec00e025fd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\334509d7-bc25-45a5-b3f8-7d645b37922a
                        Filesize

                        10KB

                        MD5

                        a74eb0b30b59c286b2dddc9d6107f5a7

                        SHA1

                        141d23e9811ab589876e7580a99a708c95adb3aa

                        SHA256

                        632c282cb1895466b788b321b1ab5cf6c59a7430b538701b930595d9e9205fe9

                        SHA512

                        48126182a9b2c7acd64d0d3b21c05f2f6f9b80241037eab0a7913986c8f30f5d37645703fb54dfae3c9a487cc33c4a6ab6a5e50e047ad8ed925bfb308c29a1c6

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\88ec0bf5-57f7-4a83-b739-97414706b76f
                        Filesize

                        745B

                        MD5

                        2e33629fd77208413b36614b02df576e

                        SHA1

                        8e9d98b502931eedc799bb780a21ea6b15e45d75

                        SHA256

                        9ecd61085c23f22b3de587ae960ce5b37a1b71a5a5acb37b3c29058f1946ca4a

                        SHA512

                        fdc764dcff1803575b9478ef4b0e46c40f3893db5a9d5910e6be58aacb935a0d3b127631d497bef35227361795854c58a93380a73996b4bbd59fee89034d718d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        75e3446fab64535e4211c85ccf07c733

                        SHA1

                        5a4319c8f09c39e6173fa264581bbad507a0e0c2

                        SHA256

                        6434ea7469f8ef5ce8fab2fbf07dd0dd958dae7eece8124520968f90c970f357

                        SHA512

                        48e8390870ae34eeb65b5978e55fad09282e4d85b99b8f3cded97c0d63b94dd73a398c2f0aa47e6cf7a3e379ece26164bf2f73d5d82c3afcb296ea181eca5374

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                        Filesize

                        184KB

                        MD5

                        bece0acf9d7f19d01c7943c54d2ad372

                        SHA1

                        aef59ca4b0fe97f32db128e103bfb98aee3b5e29

                        SHA256

                        ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8

                        SHA512

                        105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\onefile_1984_133790741060146000\trunk.exe
                        Filesize

                        18.0MB

                        MD5

                        86ddf66d8651d0baa1cc13d6f8c18dc1

                        SHA1

                        ee15109134300e555085811f4060048e245269f9

                        SHA256

                        ee045dffee8b48356106a2105803b73776b73bf7462d364b1f82540fcf72f4cf

                        SHA512

                        385fce7ded01cba93f842a1b698b78e3eb1d73833c282669ebe6bea22ec6c4957b179325614f17ecb7c7357051fb7381e011cf2ebc0f5ca2f24414f0e23a0c6c

                        Download Submit

                      • memory/352-230-0x0000000077480000-0x0000000077629000-memory.dmp

                        Filesize

                        1.7MB

                        Download

                      • memory/352-225-0x0000000000100000-0x000000000010A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/352-229-0x0000000001C20000-0x0000000002020000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/352-232-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                        Filesize

                        284KB

                        Download

                      • memory/928-487-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/928-491-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/928-490-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-396-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-387-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-385-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-394-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-393-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/952-391-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/952-389-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/1044-533-0x0000000004920000-0x00000000049E0000-memory.dmp

                        Filesize

                        768KB

                        Download

                      • memory/1044-463-0x0000000001130000-0x0000000001242000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/1048-559-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/1048-2626-0x0000000000690000-0x00000000006BC000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/1048-2627-0x0000000004B00000-0x0000000004B4C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/1048-560-0x00000000007F0000-0x0000000000888000-memory.dmp

                        Filesize

                        608KB

                        Download

                      • memory/1132-220-0x0000000004CB0000-0x00000000050B0000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/1132-221-0x0000000077480000-0x0000000077629000-memory.dmp

                        Filesize

                        1.7MB

                        Download

                      • memory/1132-223-0x0000000076B60000-0x0000000076BA7000-memory.dmp

                        Filesize

                        284KB

                        Download

                      • memory/1132-228-0x0000000000E50000-0x00000000012F9000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1132-164-0x0000000000E50000-0x00000000012F9000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1132-219-0x0000000004CB0000-0x00000000050B0000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/1180-380-0x00000000001B0000-0x00000000001BC000-memory.dmp

                        Filesize

                        48KB

                        Download

                      • memory/1516-165-0x000000013F580000-0x00000001407C7000-memory.dmp

                        Filesize

                        18.3MB

                        Download

                      • memory/1656-320-0x0000000000840000-0x00000000019D6000-memory.dmp

                        Filesize

                        17.6MB

                        Download

                      • memory/1688-424-0x0000000000BB0000-0x0000000001056000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1688-425-0x0000000000BB0000-0x0000000001056000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1688-361-0x0000000000BB0000-0x0000000001056000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1964-145-0x00000000003C0000-0x00000000008C1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/1964-143-0x00000000003C0000-0x00000000008C1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/1984-218-0x000000013F450000-0x000000013FEB7000-memory.dmp

                        Filesize

                        10.4MB

                        Download

                      • memory/2028-520-0x0000000004890000-0x0000000004952000-memory.dmp

                        Filesize

                        776KB

                        Download

                      • memory/2028-443-0x00000000000E0000-0x00000000001F6000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/2028-444-0x00000000005A0000-0x00000000005C6000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/2096-302-0x0000000000150000-0x0000000000CBF000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2096-480-0x0000000000D60000-0x000000000120B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2096-304-0x0000000000150000-0x0000000000CBF000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2096-301-0x0000000000150000-0x0000000000CBF000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2096-280-0x0000000000150000-0x0000000000CBF000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2124-0-0x0000000000340000-0x0000000000659000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2124-18-0x0000000000340000-0x0000000000659000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2124-5-0x0000000000340000-0x0000000000659000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2124-3-0x0000000000340000-0x0000000000659000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2124-2-0x0000000000341000-0x000000000036F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2124-1-0x0000000077670000-0x0000000077672000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2332-359-0x0000000006D80000-0x0000000007226000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/2332-305-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-363-0x0000000006380000-0x000000000669F000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-364-0x0000000006380000-0x000000000669F000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-298-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-423-0x0000000006D80000-0x0000000007226000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/2332-338-0x0000000006380000-0x000000000669F000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-399-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-291-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-262-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-332-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-339-0x0000000006380000-0x000000000669F000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-445-0x0000000001010000-0x0000000001332000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2332-360-0x0000000006D80000-0x0000000007226000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/2528-297-0x0000000000B60000-0x0000000000E80000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2528-381-0x0000000000A90000-0x0000000000AB2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/2528-373-0x00000000054D0000-0x0000000005626000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/2688-248-0x0000000000300000-0x0000000000622000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2688-261-0x0000000000300000-0x0000000000622000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2764-340-0x00000000001A0000-0x00000000004BF000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2764-341-0x00000000001A0000-0x00000000004BF000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-464-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-43-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-342-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-161-0x00000000066F0000-0x0000000006B99000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2844-405-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-246-0x00000000066F0000-0x0000000006A12000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-279-0x00000000066F0000-0x000000000725F000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2844-245-0x00000000066F0000-0x0000000006BF1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2844-259-0x00000000066F0000-0x0000000006BF1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2844-281-0x00000000066F0000-0x0000000006A12000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-140-0x00000000066F0000-0x0000000006BF1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2844-141-0x00000000066F0000-0x0000000006BF1000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2844-124-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-264-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-299-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-300-0x00000000066F0000-0x000000000725F000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/2844-265-0x00000000066F0000-0x0000000006B99000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2844-306-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-45-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-162-0x00000000066F0000-0x0000000006B99000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2844-42-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-19-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-21-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-20-0x0000000000AD1000-0x0000000000AFF000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2844-25-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-24-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2844-23-0x0000000000AD0000-0x0000000000DE9000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2904-49-0x00000000000B0000-0x0000000000106000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2904-53-0x00000000000B0000-0x0000000000106000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2904-52-0x00000000000B0000-0x0000000000106000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2904-51-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2904-144-0x00000000000B0000-0x0000000000106000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/4104-4719-0x0000000000AD0000-0x0000000000AFC000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/4104-2654-0x0000000000A30000-0x0000000000AC8000-memory.dmp

                        Filesize

                        608KB

                        Download

                      • memory/4104-2653-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/6780-4967-0x000000001B700000-0x000000001B9E2000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/6780-4968-0x0000000002220000-0x0000000002228000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/11132-4747-0x0000000000050000-0x00000000004A0000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/11132-4748-0x0000000000050000-0x00000000004A0000-memory.dmp

                        Filesize

                        4.3MB

                        Download