Overview

overview

10

Static

static

3

a080be4925...2N.exe

windows7-x64

10

a080be4925...2N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 09:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a080be49256e721ae4232dbf7f62b376e3057d4e3807cde205a5d715d0cb03e2N.exe

  • Size

    2.9MB

  • MD5

    34ad56a02ba60cca8fec73d153b578d0

  • SHA1

    409465ca80c9abd1bbdfeb03d307280388ee3be5

  • SHA256

    a080be49256e721ae4232dbf7f62b376e3057d4e3807cde205a5d715d0cb03e2

  • SHA512

    102e39dde4db03ca94ce68f1f022172b5f34c85ebeb13e06c4b5f11384ab535a39802a9f26441b08121e07e98864dd4be9a51ab2859c4bb695bc8a453f7a9364

  • SSDEEP

    49152:IJ01Z+B4sOfKbmJfnwNxjbZugO+Vyk7b2eRMHhg3ps:IJ0zQ4sKKbinwNLugO+VyouSZs

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 36 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 42 IoCs
  • Identifies Wine through registry keys 2 TTPs 18 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1188
      • C:\Users\Admin\AppData\Local\Temp\a080be49256e721ae4232dbf7f62b376e3057d4e3807cde205a5d715d0cb03e2N.exe
        "C:\Users\Admin\AppData\Local\Temp\a080be49256e721ae4232dbf7f62b376e3057d4e3807cde205a5d715d0cb03e2N.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2164
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
            "C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Users\Admin\AppData\Local\Temp\onefile_2976_133790755261008000\trunk.exe
              C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1764
          • C:\Users\Admin\AppData\Local\Temp\1007400001\ce3ec57e9a.exe
            "C:\Users\Admin\AppData\Local\Temp\1007400001\ce3ec57e9a.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2344
          • C:\Users\Admin\AppData\Local\Temp\1007401001\0929b97236.exe
            "C:\Users\Admin\AppData\Local\Temp\1007401001\0929b97236.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:396
          • C:\Users\Admin\AppData\Local\Temp\1007402001\47066eda2a.exe
            "C:\Users\Admin\AppData\Local\Temp\1007402001\47066eda2a.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2800
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2876
              • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
                6⤵
                • Executes dropped EXE
                PID:1548
              • C:\Users\Admin\AppData\Local\Temp\1016974001\6358ec8345.exe
                "C:\Users\Admin\AppData\Local\Temp\1016974001\6358ec8345.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2304
              • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1740
              • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2792
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\qpjngcce"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2096
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1568
              • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1676
              • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2296
                • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2508
              • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1684
                • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4164
              • C:\Users\Admin\AppData\Local\Temp\1017501001\fb745f6a75.exe
                "C:\Users\Admin\AppData\Local\Temp\1017501001\fb745f6a75.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1828
                • C:\Users\Admin\AppData\Local\Temp\1017501001\fb745f6a75.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017501001\fb745f6a75.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5152
              • C:\Users\Admin\AppData\Local\Temp\1017502001\8d0de26e64.exe
                "C:\Users\Admin\AppData\Local\Temp\1017502001\8d0de26e64.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2192
              • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                "C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2028
                • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2712
                • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:1624
                • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1568
              • C:\Users\Admin\AppData\Local\Temp\1017504001\0e090bfe0c.exe
                "C:\Users\Admin\AppData\Local\Temp\1017504001\0e090bfe0c.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2456
              • C:\Users\Admin\AppData\Local\Temp\1017505001\fc74033856.exe
                "C:\Users\Admin\AppData\Local\Temp\1017505001\fc74033856.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3660
              • C:\Users\Admin\AppData\Local\Temp\1017506001\72ee63c74e.exe
                "C:\Users\Admin\AppData\Local\Temp\1017506001\72ee63c74e.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:11040
              • C:\Users\Admin\AppData\Local\Temp\1017507001\49143750c9.exe
                "C:\Users\Admin\AppData\Local\Temp\1017507001\49143750c9.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:7756
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:8008
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:8620
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:9028
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:9284
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:9556
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:9816
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:9860
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.0.889935957\156179250" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0efc508b-83e0-4e28-979a-80b22add5d17} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 1308 126d9d58 gpu
                        9⤵
                          PID:8772
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.1.1432565933\2011394295" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12a2aec8-8399-4287-af8e-62c7b997b4d6} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 1524 1260a258 socket
                          9⤵
                            PID:3216
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.2.562450633\1513414894" -childID 1 -isForBrowser -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23852d65-009c-4867-954b-79e313c8f08f} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 2232 1887cf58 tab
                            9⤵
                              PID:4548
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.3.563204034\924041142" -childID 2 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f44f61d-24cd-4d45-81d9-cb97cf252cdd} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 2944 e5d258 tab
                              9⤵
                                PID:1800
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.4.2016841348\106355000" -childID 3 -isForBrowser -prefsHandle 3592 -prefMapHandle 3676 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9262cee2-c011-4446-b12f-356242070016} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 3556 1e088e58 tab
                                9⤵
                                  PID:9480
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.5.365781410\273241966" -childID 4 -isForBrowser -prefsHandle 3756 -prefMapHandle 3760 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02e08ec3-33c1-4086-a3bb-ea92f420939e} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 3744 1ee79658 tab
                                  9⤵
                                    PID:9604
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="9860.6.60500046\1826827526" -childID 5 -isForBrowser -prefsHandle 3812 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2852863-7dd2-45c0-b37c-9b0c75ad2b99} 9860 "\\.\pipe\gecko-crash-server-pipe.9860" 3824 1ee7a858 tab
                                    9⤵
                                      PID:9788
                              • C:\Users\Admin\AppData\Local\Temp\1017508001\bc145043dd.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017508001\bc145043dd.exe"
                                6⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:7536
                              • C:\Users\Admin\AppData\Local\Temp\1017509001\41e084f939.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017509001\41e084f939.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6384
                              • C:\Users\Admin\AppData\Local\Temp\1017510001\0b0a65994d.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017510001\0b0a65994d.exe"
                                6⤵
                                • Enumerates VirtualBox registry keys
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6396
                              • C:\Users\Admin\AppData\Local\Temp\1017511001\e2f0636cde.exe
                                "C:\Users\Admin\AppData\Local\Temp\1017511001\e2f0636cde.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3148
                                • C:\Windows\system32\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                  7⤵
                                  • Loads dropped DLL
                                  PID:10856
                                  • C:\Windows\system32\mode.com
                                    mode 65,10
                                    8⤵
                                      PID:6036
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6064
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_7.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2904
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_6.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6176
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_5.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6228
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_4.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6288
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_3.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6348
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_2.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6428
                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                      7z.exe e extracted/file_1.zip -oextracted
                                      8⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6492
                                    • C:\Windows\system32\attrib.exe
                                      attrib +H "in.exe"
                                      8⤵
                                      • Views/modifies file attributes
                                      PID:6644
                                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                      "in.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:6660
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        9⤵
                                        • Views/modifies file attributes
                                        PID:6684
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                        9⤵
                                        • Views/modifies file attributes
                                        PID:6704
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                        9⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:6732
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell ping 127.0.0.1; del in.exe
                                        9⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6792
                                        • C:\Windows\system32\PING.EXE
                                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                                          10⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:7792
                                • C:\Users\Admin\AppData\Local\Temp\1017512001\fdea18bafa.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1017512001\fdea18bafa.exe"
                                  6⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:7024
                            • C:\Users\Admin\AppData\Local\Temp\1007403001\8cc320036f.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007403001\8cc320036f.exe"
                              4⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:316
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2792
                        • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                          "C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe"
                          2⤵
                            PID:8032

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Credential Access

                        Discovery

                        Query Registry

                        7
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          29KB

                          MD5

                          bd7a7e42af68ba847e48bf5bbeddf499

                          SHA1

                          da17174e40eafbc34b8ef46b9a6db1ddc0231d86

                          SHA256

                          944b8e8037dadd17601d82861f4f2ad3b22e18ce4e4b24c4e1d561235e2d94a5

                          SHA512

                          dd1265185328d0adb70cb5a2faeec8bc314d7cf8cb72809f1a4f544db4a9cafbd2e1d51465d2077ece211c1870c59bb3fc48dd91df55f73867a79a2ebd8f7f89

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                          Filesize

                          10.2MB

                          MD5

                          d3b39a6b63c3822be6f8af9b3813bbad

                          SHA1

                          00b020e5a1c05442612f2cec7950c2814b59b1b6

                          SHA256

                          786f1331a0618485b31ba763911b14fcec691bf9897bee8f42680076092b7a2f

                          SHA512

                          a5c7504b29798fdabf610cf65716ec1d7745956f470d86de12a52b3c8731f858764fdf78647e50b3111622e7e65f05f82cd258b98c1a0f45ef7fdc088647d4ff

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007400001\ce3ec57e9a.exe
                          Filesize

                          2.7MB

                          MD5

                          f6c52a4dc3fd9e09bedd4f46b2128286

                          SHA1

                          62645d6c5d31e3231a9b6c623ce9977ee682086e

                          SHA256

                          e9408b42c1db1ab5b6bdcb0663d90fa868601bc75f207f004d4cd072f48560d5

                          SHA512

                          47a68c788c70f41b1c0cca35f0a983099b23ca547db0ee81ff3248be85f712a75e4eab2fea885b81266d2dc96acf5a5be5852e70363d5894bce004f7065ba273

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007401001\0929b97236.exe
                          Filesize

                          1.9MB

                          MD5

                          27fee9f59528fe47fa6b7c0a81e24f7d

                          SHA1

                          226a9ea05b200a4eca2db8f4d2722678c26252e8

                          SHA256

                          641935a9640a37c5d213d1cdd51186a4536b63d1692b0492e8669cef646d1011

                          SHA512

                          61b8d79f2cadf042d8be73e40b7edfb584a2ec91d04315f37d697237bffd734b18becfe97eff2619ffd0aeae84df1ff7ff9c9853227e019f6fd51d6b8d93b3b0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007402001\47066eda2a.exe
                          Filesize

                          2.9MB

                          MD5

                          bc56bdefccd1c98734fb41e1311e5c98

                          SHA1

                          afeed0bc3be48946a8cdda7f1f39d669f7b90d6b

                          SHA256

                          58b56acf9b7d2ca16501908af384ecaa9d5bcb6e95c8ec7faa325460112b29a7

                          SHA512

                          6290da8dfd0ca0d13b9a8dc36f0596660888188cf730402c5de1fa128e3d979073fe0cd38690e08f48af249051a954a93f4b04fffecfaa88c9c474d2d9094142

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1007403001\8cc320036f.exe
                          Filesize

                          4.2MB

                          MD5

                          03ae071235d37edc3ea30848462bccbc

                          SHA1

                          d8425df6c157fc8699596f64a0bf996692ebc947

                          SHA256

                          72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536

                          SHA512

                          2ef13be57bdebf61bf59e7b39a5c522f91ddb9d003a1a9a66b3fa9c7ef35ead57626858050ef2615ed87da4a32759328121e63fb46b2b4ce2f949caeea8871dc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                          Filesize

                          17.6MB

                          MD5

                          3c224e3fc892719dc1e302378e533579

                          SHA1

                          0a65062e1426a95bfeca355398b6fdc4912fb6b1

                          SHA256

                          64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

                          SHA512

                          554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016974001\6358ec8345.exe
                          Filesize

                          2.8MB

                          MD5

                          b0e530a964a21586907991e273548b36

                          SHA1

                          dd3f3656be399eb4572ef6852673babb4b6c86c1

                          SHA256

                          e40f13a88d88505606849ecb20e9319058ffe53a10c0788e9e1267d787701732

                          SHA512

                          4c22ea8af5f097b016ab5bbbef795471080a1d8fc33de3d6ea5c3f11c53bea449583bd367f80a79459b0980a05281a274c498954a2741f0ece60f6897e326477

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                          Filesize

                          1.8MB

                          MD5

                          ff279f4e5b1c6fbda804d2437c2dbdc8

                          SHA1

                          2feb3762c877a5ae3ca60eeebc37003ad0844245

                          SHA256

                          e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                          SHA512

                          c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                          Filesize

                          21KB

                          MD5

                          14becdf1e2402e9aa6c2be0e6167041e

                          SHA1

                          72cbbae6878f5e06060a0038b25ede93b445f0df

                          SHA256

                          7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                          SHA512

                          16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                          Filesize

                          1.8MB

                          MD5

                          25fb9c54265bbacc7a055174479f0b70

                          SHA1

                          4af069a2ec874703a7e29023d23a1ada491b584e

                          SHA256

                          552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                          SHA512

                          7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                          Filesize

                          1.1MB

                          MD5

                          ef08a45833a7d881c90ded1952f96cb4

                          SHA1

                          f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                          SHA256

                          33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                          SHA512

                          74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
                          Filesize

                          1.1MB

                          MD5

                          68c0e4eefd4c6a76cff542ef57a49ca2

                          SHA1

                          8aa521628b89f3ce539269229834da2a87060e76

                          SHA256

                          4e417fd6cce7dbff53412a820f4813d01da0e7f20e7615220aaa1372cc59db83

                          SHA512

                          d722432cdf836269ed3a6e181dd02c6e49d719ca9d84aa5582447d480f43ccc0f79f2d9a9191171d21ec2ea3306a97c60a0aff6707fa3ca9e81e957bf8aad283

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017501001\fb745f6a75.exe
                          Filesize

                          3.1MB

                          MD5

                          c00a67d527ef38dc6f49d0ad7f13b393

                          SHA1

                          7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                          SHA256

                          12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                          SHA512

                          9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017503001\b5e4324800.exe
                          Filesize

                          758KB

                          MD5

                          afd936e441bf5cbdb858e96833cc6ed3

                          SHA1

                          3491edd8c7caf9ae169e21fb58bccd29d95aefef

                          SHA256

                          c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                          SHA512

                          928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017505001\fc74033856.exe
                          Filesize

                          1.8MB

                          MD5

                          6e97405d1faad641c284ffbaf6d8ef86

                          SHA1

                          8c3c9bacde73d28e58f700b71a7410e0cfce2d2b

                          SHA256

                          348cd9077700714a7810bc7459eb708f5c0077db50ed1603c0b988d6c18ac6a1

                          SHA512

                          e6a37a3e9c5eb8404d84860efd16b19c6eacd6d8147aba0babe083258293081cb8faffb6dbf7f55ea606e7f7741b3f16608ac8a6996a0b34416cb7e4a535b40e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017507001\49143750c9.exe
                          Filesize

                          945KB

                          MD5

                          2252bd7350c2fe134502098fffd3fe0e

                          SHA1

                          cac34836fb85e204b1c339ee1e8e40443c03386a

                          SHA256

                          5d0c43f6d6c41bfe8231be3c771cc1f4b1018e7ccd25aa5bf96f371347318e6a

                          SHA512

                          617ad60959767d481733f0a80709e863648fd4e1c64198625db0bca94f002d48e2b2c2ab145384f349e6d12f045006f0130f7acf1c583b89c6d69465dc638a6c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017508001\bc145043dd.exe
                          Filesize

                          1.7MB

                          MD5

                          80c7f6ba56476f282f1eb23421522f83

                          SHA1

                          325816fc1e9a95a090caf1b1aab58599c735e68f

                          SHA256

                          5ececd92978f414895b062a77afaf279d45746a7fa6a341a38ff9358958bd2ac

                          SHA512

                          acb03c8e6a7f450d1238564c93b3fb8f76e6a0622e09777fd55194b06ff409feba480495b893fe44de6299ea4ae734c114e0caa2cac9050cc08087d0d2a4bb30

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017510001\0b0a65994d.exe
                          Filesize

                          4.3MB

                          MD5

                          dbf74d303e2652e6fd1e1382f8ef0d77

                          SHA1

                          2084b62389ca701b4d81dbfa298d1ae7b3e659ad

                          SHA256

                          22d3055c50ecee723f18c444d0f9124affd0d2d4f4507796ddbfdb9a90afad2c

                          SHA512

                          aa112b8d9837bce7acf8d3de449dd5d346abb30f76b5193be2218c430e5588016518425ff5917836cb48fc4dce47bee5213a02987fe81dede251046ca163ecef

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1017511001\e2f0636cde.exe
                          Filesize

                          4.2MB

                          MD5

                          3a425626cbd40345f5b8dddd6b2b9efa

                          SHA1

                          7b50e108e293e54c15dce816552356f424eea97a

                          SHA256

                          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                          SHA512

                          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          Filesize

                          458KB

                          MD5

                          619f7135621b50fd1900ff24aade1524

                          SHA1

                          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                          SHA256

                          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                          SHA512

                          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                          Filesize

                          440B

                          MD5

                          3626532127e3066df98e34c3d56a1869

                          SHA1

                          5fa7102f02615afde4efd4ed091744e842c63f78

                          SHA256

                          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                          SHA512

                          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\onefile_2976_133790755261008000\python312.dll
                          Filesize

                          6.6MB

                          MD5

                          166cc2f997cba5fc011820e6b46e8ea7

                          SHA1

                          d6179213afea084f02566ea190202c752286ca1f

                          SHA256

                          c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                          SHA512

                          49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                          Filesize

                          7KB

                          MD5

                          d9443d4f8091029e90ecc8fae6d6db19

                          SHA1

                          f6013ce72ad5d762521aae666e18bdabc411dba7

                          SHA256

                          6af920d395620acc907df51efcff6ed88ba6cd0bbc077c7e859432e743781f5b

                          SHA512

                          70ffbcf1ffdb0e8fb9559299b5b8de00cb0c842011065179e668192f8b68b7c910f0e6b106b14e772118164db98fcfd824954a2d8acb1e60b2d465769a11c14f

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          f4ca2ca39769a700c88f6526be282b11

                          SHA1

                          8609322c4fe85fc70f3706886979b902634e0d04

                          SHA256

                          8c0e20ffff7c28fe02ed5d5441da4b677389d76eae5a79c748bd13de1dca1a99

                          SHA512

                          69349254de74ad0b84c355c01e0ee328a784ed4c9e17a0041f097e6b90fed579b560d15d11a601016f5bed9f4bca51b154c39e4ffb63ef73200f48676a21ca4b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\ae7c764b-76d8-49bf-adb6-dff5e8cd9393
                          Filesize

                          745B

                          MD5

                          a0e1792272cece2a37a78d3e4b159b71

                          SHA1

                          b6ea0a79203aa654647c0a21be5e64a88e3313bc

                          SHA256

                          3c6b97235c07b836e2756aafc49006d536aa1dfaea142fbba684fdf1e8bd5c71

                          SHA512

                          29184adf2e976a779b04d58552c996672d35a919f1086114f65bd397465030998052ecd15d05bb8d69e0ca3de3a770eccc1ed68b73d7f7e286d8859f4063b3b5

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\e2c3ab47-f770-41de-85f0-691ea0f4fce2
                          Filesize

                          9KB

                          MD5

                          a073f4d9133eafb61542dc81465c6761

                          SHA1

                          4d0f9ffdc0be403cd1ef09e7c582ed634a4eb665

                          SHA256

                          51f2e815a2094157086dd8347a38ba882906ce1770b7108b55bafaab8e9d090d

                          SHA512

                          bbf6a9608a70e05ea1f16e10ca98083f752f25330b97743f171f8809b67f9bbbf945723c1c15a9f9f75fdb0c5ea8904672154b32f954f37ba8537910a7d7cb3c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          2c3c55ada2bb1e55404b1da16bdf38f6

                          SHA1

                          a78348894f4f4c45c91638992316628c76c3b4ff

                          SHA256

                          f3b4f54d956ff5c98464967e3c64704606011491649c2fbedc11d129fff7b4e3

                          SHA512

                          ef0fed5b5ca37a37c102f873789dacfc6e2dddc28c3264f970bcb227940b24281719c75871604f0ff41b9cd9444680a528f0e7f0c0b3fafd57f0b3ad31ace4c2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          a2010687f0c5fc08b12d2885734c90e1

                          SHA1

                          d2da18542b5b858181965642a7a2c72ab12d7ead

                          SHA256

                          a8572c46518e4cd57dffa752a1f597a89ea53ac4bddf1ae32ffaa900a59cdbee

                          SHA512

                          f41b51d3b150884faa8e8e9bc07245e1cdfac00f406f68f6a7696b2ba88929d473d96aa5d280a69ff36dfa028f40ebae899cf9257c97f9b5e3fccf1b7208bdf1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          9561729d50873bbcbc1c6fbbcfec040c

                          SHA1

                          deed43ab83fe8506e6c46011a1bf0e002ea83ff5

                          SHA256

                          cf71cbb77ded6c9351235847859d9741e75fb6031644df5e9b99a543f1052cae

                          SHA512

                          30edd3e2071568c106473272d8112580f9d9ea9695dc534908b5302cc47692c60bf1977246f87cd3cd6abe4220b3b1b287b67c884792283f2c9968b67159fe56

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                          Filesize

                          2.9MB

                          MD5

                          34ad56a02ba60cca8fec73d153b578d0

                          SHA1

                          409465ca80c9abd1bbdfeb03d307280388ee3be5

                          SHA256

                          a080be49256e721ae4232dbf7f62b376e3057d4e3807cde205a5d715d0cb03e2

                          SHA512

                          102e39dde4db03ca94ce68f1f022172b5f34c85ebeb13e06c4b5f11384ab535a39802a9f26441b08121e07e98864dd4be9a51ab2859c4bb695bc8a453f7a9364

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\onefile_2976_133790755261008000\trunk.exe
                          Filesize

                          18.0MB

                          MD5

                          86ddf66d8651d0baa1cc13d6f8c18dc1

                          SHA1

                          ee15109134300e555085811f4060048e245269f9

                          SHA256

                          ee045dffee8b48356106a2105803b73776b73bf7462d364b1f82540fcf72f4cf

                          SHA512

                          385fce7ded01cba93f842a1b698b78e3eb1d73833c282669ebe6bea22ec6c4957b179325614f17ecb7c7357051fb7381e011cf2ebc0f5ca2f24414f0e23a0c6c

                          Download Submit

                        • memory/316-256-0x0000000001090000-0x0000000001BE9000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/316-263-0x0000000001090000-0x0000000001BE9000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/316-265-0x0000000001090000-0x0000000001BE9000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/316-262-0x0000000001090000-0x0000000001BE9000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/396-196-0x0000000004C80000-0x0000000005080000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/396-216-0x0000000000C70000-0x0000000001119000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/396-199-0x00000000769D0000-0x0000000076A17000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/396-197-0x00000000770D0000-0x0000000077279000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/396-195-0x0000000004C80000-0x0000000005080000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/396-193-0x0000000000C70000-0x0000000001119000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1548-280-0x00000000002E0000-0x0000000001476000-memory.dmp

                          Filesize

                          17.6MB

                          Download

                        • memory/1568-467-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-463-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-465-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-473-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-470-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-461-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1568-471-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1568-472-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1676-475-0x0000000000C90000-0x000000000113B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1676-408-0x0000000000C90000-0x000000000113B000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1684-406-0x0000000001270000-0x0000000001382000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/1684-490-0x0000000001140000-0x0000000001200000-memory.dmp

                          Filesize

                          768KB

                          Download

                        • memory/1740-321-0x00000000001D0000-0x0000000000676000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1740-410-0x00000000001D0000-0x0000000000676000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1740-476-0x00000000001D0000-0x0000000000676000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1740-368-0x00000000001D0000-0x0000000000676000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1740-369-0x00000000001D0000-0x0000000000676000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/1764-121-0x000000013FB30000-0x0000000140D77000-memory.dmp

                          Filesize

                          18.3MB

                          Download

                        • memory/1828-425-0x00000000008E0000-0x0000000000C08000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1828-4891-0x0000000000530000-0x0000000000552000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/1828-4890-0x0000000005530000-0x0000000005686000-memory.dmp

                          Filesize

                          1.3MB

                          Download

                        • memory/2164-17-0x0000000000990000-0x0000000000CA9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2164-19-0x0000000006AD0000-0x0000000006DE9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2164-1-0x00000000772C0000-0x00000000772C2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2164-2-0x0000000000991000-0x00000000009BF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2164-18-0x0000000006AD0000-0x0000000006DE9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2164-3-0x0000000000990000-0x0000000000CA9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2164-5-0x0000000000990000-0x0000000000CA9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2164-0-0x0000000000990000-0x0000000000CA9000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2296-457-0x0000000005CD0000-0x0000000005D92000-memory.dmp

                          Filesize

                          776KB

                          Download

                        • memory/2296-387-0x0000000000F40000-0x0000000001056000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/2296-388-0x0000000000270000-0x0000000000296000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/2304-300-0x0000000000130000-0x000000000043E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2304-299-0x0000000000130000-0x000000000043E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2344-119-0x0000000000990000-0x0000000000E83000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2344-120-0x0000000000990000-0x0000000000E83000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2508-495-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-500-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-501-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-491-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-2569-0x0000000000650000-0x000000000067C000-memory.dmp

                          Filesize

                          176KB

                          Download

                        • memory/2508-505-0x0000000000C10000-0x0000000000CA1000-memory.dmp

                          Filesize

                          580KB

                          Download

                        • memory/2508-504-0x0000000000C10000-0x0000000000CA8000-memory.dmp

                          Filesize

                          608KB

                          Download

                        • memory/2508-499-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2508-2570-0x0000000000A80000-0x0000000000ACC000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/2508-493-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-503-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2508-497-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/2792-223-0x00000000770D0000-0x0000000077279000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2792-210-0x0000000000080000-0x000000000008A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2792-222-0x00000000008B0000-0x0000000000CB0000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2792-339-0x00000000013B0000-0x00000000013BC000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2792-225-0x00000000769D0000-0x0000000076A17000-memory.dmp

                          Filesize

                          284KB

                          Download

                        • memory/2800-235-0x0000000006C90000-0x0000000006FB8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2800-238-0x0000000000CE0000-0x0000000001008000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2800-220-0x0000000000CE0000-0x0000000001008000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-324-0x0000000006250000-0x000000000655E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2876-266-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-259-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-313-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-260-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-240-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-409-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-323-0x0000000006250000-0x000000000655E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2876-298-0x0000000006250000-0x000000000655E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2876-297-0x0000000006250000-0x000000000655E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2876-474-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-319-0x0000000006870000-0x0000000006D16000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2876-318-0x0000000006870000-0x0000000006D16000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2876-367-0x0000000001180000-0x00000000014A8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2876-349-0x0000000006870000-0x0000000006D16000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2976-174-0x000000013FE00000-0x0000000140867000-memory.dmp

                          Filesize

                          10.4MB

                          Download

                        • memory/3004-218-0x00000000069F0000-0x0000000006EE3000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/3004-194-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-348-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-217-0x00000000069F0000-0x0000000006EE3000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/3004-407-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-219-0x00000000063D0000-0x00000000066F8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/3004-301-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-100-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-118-0x00000000069F0000-0x0000000006EE3000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/3004-456-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-29-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-258-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-191-0x00000000069F0000-0x0000000006E99000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3004-190-0x00000000069F0000-0x0000000006E99000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3004-28-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-27-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-261-0x00000000069F0000-0x0000000007549000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/3004-21-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-26-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-24-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-23-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-22-0x0000000000B81000-0x0000000000BAF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/3004-239-0x00000000069F0000-0x0000000006E99000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3004-117-0x00000000069F0000-0x0000000006EE3000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/3004-264-0x0000000000B80000-0x0000000000E99000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3004-257-0x00000000063D0000-0x00000000066F8000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/3004-255-0x00000000069F0000-0x0000000007549000-memory.dmp

                          Filesize

                          11.3MB

                          Download

                        • memory/4164-4661-0x0000000000650000-0x000000000067C000-memory.dmp

                          Filesize

                          176KB

                          Download

                        • memory/4164-2596-0x0000000000BC0000-0x0000000000C58000-memory.dmp

                          Filesize

                          608KB

                          Download

                        • memory/4164-2595-0x0000000000400000-0x0000000000464000-memory.dmp

                          Filesize

                          400KB

                          Download

                        • memory/6792-5013-0x000000001B6B0000-0x000000001B992000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/6792-5014-0x0000000000370000-0x0000000000378000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/7536-4712-0x0000000000340000-0x0000000000790000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/7536-4711-0x0000000000340000-0x0000000000790000-memory.dmp

                          Filesize

                          4.3MB

                          Download