Overview

overview

10

Static

static

3

055c34101c...95.exe

windows7-x64

10

055c34101c...95.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2024 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895.exe

  • Size

    2.8MB

  • MD5

    8cbe0ced0c0f7bfbdf19128ba80adb99

  • SHA1

    15e615a0fe64fe5200dd916232d9bc26b1c3d815

  • SHA256

    055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895

  • SHA512

    4b258260770b08fdd8f14b7bf0e703b8ca5010e4698e457bc0cfc76c246fb9e7c60ee4d2068b717f8205c2c1954d3b6b8742ed2547b67082f5b89c63d850e938

  • SSDEEP

    49152:kNv6yZz1fXBB9nu/SkIK3OdW+56W0xSDmoJb3:s6yZz1fRB9nu/SkIK3ibpDmA

Score
10/10
amadeylumma9c9aa5discoveryevasionexecutionpersistencestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 39 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895.exe
        "C:\Users\Admin\AppData\Local\Temp\055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:304
          • C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe
            "C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe"
            4⤵
            • Executes dropped EXE
            PID:2656
          • C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe
            "C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe
              "C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1792
          • C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe
            "C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe"
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANwA5ADEANgAwADAAMQBcAFUAWgBBAGoAOAB3AGMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANwA5ADEANgAwADAAMQBcAFUAWgBBAGoAOAB3AGMALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEEAcABwAHIAbwB4AGkAbQBhAHQAZQBTAGkAegBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEEAcABwAHIAbwB4AGkAbQBhAHQAZQBTAGkAegBlAC4AZQB4AGUA
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1284
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 740
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:1356
          • C:\Users\Admin\AppData\Local\Temp\1018024001\b3179ddffa.exe
            "C:\Users\Admin\AppData\Local\Temp\1018024001\b3179ddffa.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2984
          • C:\Users\Admin\AppData\Local\Temp\1018104001\5bff4ae5b7.exe
            "C:\Users\Admin\AppData\Local\Temp\1018104001\5bff4ae5b7.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1420
            • C:\Users\Admin\AppData\Local\Temp\1018104001\5bff4ae5b7.exe
              "C:\Users\Admin\AppData\Local\Temp\1018104001\5bff4ae5b7.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3180
          • C:\Users\Admin\AppData\Local\Temp\1018105001\f0962d902e.exe
            "C:\Users\Admin\AppData\Local\Temp\1018105001\f0962d902e.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3736
          • C:\Users\Admin\AppData\Local\Temp\1018106001\c7ac8b2876.exe
            "C:\Users\Admin\AppData\Local\Temp\1018106001\c7ac8b2876.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4240
            • C:\Users\Admin\AppData\Local\Temp\1018106001\c7ac8b2876.exe
              "C:\Users\Admin\AppData\Local\Temp\1018106001\c7ac8b2876.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6080
          • C:\Users\Admin\AppData\Local\Temp\1018107001\a26f2f14d4.exe
            "C:\Users\Admin\AppData\Local\Temp\1018107001\a26f2f14d4.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4688
          • C:\Users\Admin\AppData\Local\Temp\1018108001\5373bd9355.exe
            "C:\Users\Admin\AppData\Local\Temp\1018108001\5373bd9355.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5156
          • C:\Users\Admin\AppData\Local\Temp\1018109001\26fbef1867.exe
            "C:\Users\Admin\AppData\Local\Temp\1018109001\26fbef1867.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5776
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\cfesajd"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5964
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:9936
          • C:\Users\Admin\AppData\Local\Temp\1018110001\1a9c033c34.exe
            "C:\Users\Admin\AppData\Local\Temp\1018110001\1a9c033c34.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:10224
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              5⤵
              • Loads dropped DLL
              PID:3292
              • C:\Windows\system32\mode.com
                mode 65,10
                6⤵
                  PID:3400
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3448
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_7.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3588
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_6.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3776
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_5.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3856
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_4.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3976
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_3.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4076
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_2.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4176
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_1.zip -oextracted
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4256
                • C:\Windows\system32\attrib.exe
                  attrib +H "in.exe"
                  6⤵
                  • Views/modifies file attributes
                  PID:4388
                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                  "in.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4404
                  • C:\Windows\system32\attrib.exe
                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    7⤵
                    • Views/modifies file attributes
                    PID:4460
                  • C:\Windows\system32\attrib.exe
                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    7⤵
                    • Views/modifies file attributes
                    PID:4480
                  • C:\Windows\system32\schtasks.exe
                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4512
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell ping 127.0.0.1; del in.exe
                    7⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4548
                    • C:\Windows\system32\PING.EXE
                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                      8⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:2972
            • C:\Users\Admin\AppData\Local\Temp\1018111001\ee0ae43080.exe
              "C:\Users\Admin\AppData\Local\Temp\1018111001\ee0ae43080.exe"
              4⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:832
            • C:\Users\Admin\AppData\Local\Temp\1018112001\585d15ddcd.exe
              "C:\Users\Admin\AppData\Local\Temp\1018112001\585d15ddcd.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:4568
            • C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe
              "C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:5300
              • C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe
                "C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe"
                5⤵
                • Executes dropped EXE
                PID:5680
              • C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe
                "C:\Users\Admin\AppData\Local\Temp\1018113001\eaffa2d4bb.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5712
            • C:\Users\Admin\AppData\Local\Temp\1018114001\c59adc6d69.exe
              "C:\Users\Admin\AppData\Local\Temp\1018114001\c59adc6d69.exe"
              4⤵
              • Executes dropped EXE
              PID:492
            • C:\Users\Admin\AppData\Local\Temp\1018115001\3c31b3e3c1.exe
              "C:\Users\Admin\AppData\Local\Temp\1018115001\3c31b3e3c1.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:6360
              • C:\Users\Admin\AppData\Local\Temp\1018115001\3c31b3e3c1.exe
                "C:\Users\Admin\AppData\Local\Temp\1018115001\3c31b3e3c1.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2924
            • C:\Users\Admin\AppData\Local\Temp\1018116001\d15273a03c.exe
              "C:\Users\Admin\AppData\Local\Temp\1018116001\d15273a03c.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6520
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Add-MpPreference -ExclusionPath "C:\feayps"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6660
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6816
            • C:\Users\Admin\AppData\Local\Temp\1018117001\c79eeace14.exe
              "C:\Users\Admin\AppData\Local\Temp\1018117001\c79eeace14.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:7248
            • C:\Users\Admin\AppData\Local\Temp\1018118001\7b44644e33.exe
              "C:\Users\Admin\AppData\Local\Temp\1018118001\7b44644e33.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:7856
            • C:\Users\Admin\AppData\Local\Temp\1018119001\6e78a3cb47.exe
              "C:\Users\Admin\AppData\Local\Temp\1018119001\6e78a3cb47.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:8340
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:8416
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:8636
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:8804
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:8956
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:9076
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                5⤵
                  PID:9200
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    6⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2492
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.0.1275378654\210650365" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {876a4116-4d4f-438f-8299-27dfdcea16d0} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1276 110bbf58 gpu
                      7⤵
                        PID:9516
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.1.1973026540\525594211" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ba548cd-57eb-490a-be8e-1f285b22e94c} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 1492 d74b58 socket
                        7⤵
                          PID:9640
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.2.7232946\2074564379" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77315c15-000d-43b0-8448-69bccbdb7bae} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2108 1a8b1f58 tab
                          7⤵
                            PID:3096
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.3.1456431494\796407134" -childID 2 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15e67fa0-e4fa-4db8-8e5b-8e5d2e880f88} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 2864 1b79e958 tab
                            7⤵
                              PID:264
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.4.1840387097\1198504279" -childID 3 -isForBrowser -prefsHandle 3736 -prefMapHandle 3732 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1896a42a-e5a6-4582-ab9f-46d3a285d563} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3748 1bd4fe58 tab
                              7⤵
                                PID:1936
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.5.2104227064\2100945327" -childID 4 -isForBrowser -prefsHandle 3844 -prefMapHandle 3848 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc179d13-8d67-4505-9e16-6794565ec675} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3756 1bd50458 tab
                                7⤵
                                  PID:2416
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2492.6.1516795082\2056251601" -childID 5 -isForBrowser -prefsHandle 3856 -prefMapHandle 3916 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9259b8a9-cf78-4709-ad32-8dbf3cf690d6} 2492 "\\.\pipe\gecko-crash-server-pipe.2492" 3936 1bd51958 tab
                                  7⤵
                                    PID:1804
                            • C:\Users\Admin\AppData\Local\Temp\1018120001\f42ccbfef9.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018120001\f42ccbfef9.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5636
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5548
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {8A330D9D-7A07-4F60-9497-8B2CB0F1B718} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
                        1⤵
                        • Loads dropped DLL
                        PID:5400
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5552
                          • C:\Windows\explorer.exe
                            explorer.exe
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5596
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            3⤵
                            • Drops file in System32 directory
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5812
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:1712
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6128
                          • C:\Windows\explorer.exe
                            explorer.exe
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2228
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            3⤵
                            • Drops file in System32 directory
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:868
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2304

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Modify Registry

                      2
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Discovery

                      Query Registry

                      7
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp
                        Filesize

                        31KB

                        MD5

                        ff54be723af3b7067779d86ea20fcd44

                        SHA1

                        6d5c87cd8f23039522b6659e68b756a6bd682d13

                        SHA256

                        ca6927c8d2897e0ef432f1515364021b59b86b03aab07a6ffba58c9dde44487b

                        SHA512

                        ee60afc17dc980b4746c8d7be7b49b71c9f8017af4cbb0de69837f3b98ab08023e74c08d7940e827d760c1cd2bc88e9dd3667d392f395c143b147ba4b26d3ac5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe
                        Filesize

                        1.3MB

                        MD5

                        669ed3665495a4a52029ff680ec8eba9

                        SHA1

                        7785e285365a141e307931ca4c4ef00b7ecc8986

                        SHA256

                        2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                        SHA512

                        bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe
                        Filesize

                        791KB

                        MD5

                        e8af4d0d0b47ac68d762b7f288ae8e6e

                        SHA1

                        1d65f31526cc20ab41d6b1625d6674d7f13e326c

                        SHA256

                        b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

                        SHA512

                        80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe
                        Filesize

                        935KB

                        MD5

                        5b99682cb740202d783dde58ca97f045

                        SHA1

                        cecae054552ce295feaa0717d2a33e870addcadd

                        SHA256

                        724e283e1bb29a150c9bebc21bdf0e250e2d87257bf86c889bbe7544329c6882

                        SHA512

                        c37a2cb06407729344adb85d814223a24ec4fa65f711c7f02c0e77395ec969b7e1bd64a6f5806d4e2d88c8461587d68b6aae3378d2cf5c92f1ade2aacc13f2b2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018024001\b3179ddffa.exe
                        Filesize

                        2.7MB

                        MD5

                        af13a753c8a31d591e122e15c1d717bd

                        SHA1

                        396f37a0874f2bea3d397b7fe7a770f2ef6be173

                        SHA256

                        05724ef44c4401e17e540e65e3ab7d0d0ffcdb933040cfd38920f9eba67a5845

                        SHA512

                        b3bbb544e6af579fc3c2f6c52bbac936597b012dc9d094abc7f503122fc3619d6a3a4d4f1b53ef0b3cddd44f6e3f141003f1747b599318c0891131564afef6b2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018104001\5bff4ae5b7.exe
                        Filesize

                        758KB

                        MD5

                        afd936e441bf5cbdb858e96833cc6ed3

                        SHA1

                        3491edd8c7caf9ae169e21fb58bccd29d95aefef

                        SHA256

                        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                        SHA512

                        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018105001\f0962d902e.exe
                        Filesize

                        1.8MB

                        MD5

                        25fb9c54265bbacc7a055174479f0b70

                        SHA1

                        4af069a2ec874703a7e29023d23a1ada491b584e

                        SHA256

                        552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                        SHA512

                        7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018106001\c7ac8b2876.exe
                        Filesize

                        1.1MB

                        MD5

                        ef08a45833a7d881c90ded1952f96cb4

                        SHA1

                        f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                        SHA256

                        33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                        SHA512

                        74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018107001\a26f2f14d4.exe
                        Filesize

                        1.8MB

                        MD5

                        ff279f4e5b1c6fbda804d2437c2dbdc8

                        SHA1

                        2feb3762c877a5ae3ca60eeebc37003ad0844245

                        SHA256

                        e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                        SHA512

                        c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018108001\5373bd9355.exe
                        Filesize

                        1.9MB

                        MD5

                        ed9fb7650e33c7fa5cf0c7dd57483eed

                        SHA1

                        847fd45efadd1a7c37548771b07a5f007ab4aa40

                        SHA256

                        37c00d35c082a812602fe1609e5bc87b20864123358828bbc47de9d7498694e1

                        SHA512

                        440ea66a6056b283312b32c1195f88cd6e8a518af0a8a88c0c51c4b93bad3ef1ce6c5712d84088061192ed4530105f15de04d44e4d3d1ca25cf0b5bd849ccb80

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018109001\26fbef1867.exe
                        Filesize

                        21KB

                        MD5

                        14becdf1e2402e9aa6c2be0e6167041e

                        SHA1

                        72cbbae6878f5e06060a0038b25ede93b445f0df

                        SHA256

                        7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                        SHA512

                        16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018110001\1a9c033c34.exe
                        Filesize

                        4.2MB

                        MD5

                        3a425626cbd40345f5b8dddd6b2b9efa

                        SHA1

                        7b50e108e293e54c15dce816552356f424eea97a

                        SHA256

                        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                        SHA512

                        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018111001\ee0ae43080.exe
                        Filesize

                        4.2MB

                        MD5

                        8664a5a6e958f985735b8a17171550bc

                        SHA1

                        3deb8bfcdc32ddf9a678f44c59aa70e3a7f5bb5f

                        SHA256

                        ffcc7288342a28c0580bea142951bf4ac33a3f391d8f9323f9e74293d2817e82

                        SHA512

                        adc1c9bc3af3a39b066a9231ef6bd9119d48dff41a4e5bfac695c40a5d2b9e5e9f4eb6e4779408cd7f22fe0e7e5697d7fa314778864fd13bb321db3f8d0514b0

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018112001\585d15ddcd.exe
                        Filesize

                        4.3MB

                        MD5

                        35e2c99a2fed28f4148ef7f4c1431df4

                        SHA1

                        8b05aa4709fd09892238baa7a14f42d58dd58d14

                        SHA256

                        d01a1b39c935e182b6e4d6c2c15dfe35a59b086fe55bbea0338bc35626a1d3df

                        SHA512

                        e03cfe592504f165fdd3a04dc3293d2ac786c51b9b59f6ebc0560013aadde66bdfdcb3c93cd225b51cdff831050e1bfc94977ed761006f10a852fe132a6cebb8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018115001\3c31b3e3c1.exe
                        Filesize

                        3.1MB

                        MD5

                        c00a67d527ef38dc6f49d0ad7f13b393

                        SHA1

                        7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                        SHA256

                        12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                        SHA512

                        9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018116001\d15273a03c.exe
                        Filesize

                        21KB

                        MD5

                        04f57c6fb2b2cd8dcc4b38e4a93d4366

                        SHA1

                        61770495aa18d480f70b654d1f57998e5bd8c885

                        SHA256

                        51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                        SHA512

                        53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018117001\c79eeace14.exe
                        Filesize

                        1.8MB

                        MD5

                        905a055e55bf1bead1d2df06d2fc9888

                        SHA1

                        0b69e66478bdaa14ea3da0f88cdf8a6b84ba3731

                        SHA256

                        7f0d53beb82e6590383049463e0375c9905a277b0af46ee79f614ecbe343fd95

                        SHA512

                        f0295c0e8cc6a3c1146a20c7107b1e7c17cd66d632f8b91b461062451e9ef940e116273cc13b51d780826c9ceee903f3cab7261b43ec9a76ccd01e96de3812d9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018118001\7b44644e33.exe
                        Filesize

                        2.8MB

                        MD5

                        52b49bc4dc2268ae5d827a065d5723f7

                        SHA1

                        0fd5a4079dac939869e243966987ece4e146a7fa

                        SHA256

                        a29343dda6e66875bb76baed5a655a8ea66e0c9759ac76bc3673d3453746282b

                        SHA512

                        73ce864ecb62eb1d6e022bce9fbf55d2a5765b534e42da616a0560e8c4e8ae034a340f515f234153ae786513a7da76a8ef3b317ef95050afd58fc4eb8dc23adf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018119001\6e78a3cb47.exe
                        Filesize

                        947KB

                        MD5

                        2b09cc7c70204429da7ec05b29fd0487

                        SHA1

                        688a15b873282d198c33bf387134c4f893878a06

                        SHA256

                        199114dbdd79a936831dbf3cd57f1ec188bd7ac86ab3971b5dda91040df20408

                        SHA512

                        382b93aff7c7118a120aa3414efdc428887f5c6353345b12fb62c994d16fa4a26638b988ca46afcf5c86a18da34eafa7770954a6c22a1ab57fe19b2651b87cd1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1018120001\f42ccbfef9.exe
                        Filesize

                        2.7MB

                        MD5

                        4e8d2ba58e7eaf8e12bbfbae1766da3b

                        SHA1

                        c3ad2a4dde5cbd84f903876484f7079b130af930

                        SHA256

                        4b1089921522eb16c95c7bd868ae9e0688d035714f94b0a3564503b65126614a

                        SHA512

                        b21e3215e8a8f3ccd30cea8d7bfd3be36c60cffa115106409aae78654081984f2c4536c6180dd255c5e52da07a374f727b6b48c0f7b8686129f5f70e882beea9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\CabC8BD.tmp
                        Filesize

                        70KB

                        MD5

                        49aebf8cbd62d92ac215b2923fb1b9f5

                        SHA1

                        1723be06719828dda65ad804298d0431f6aff976

                        SHA256

                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                        SHA512

                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\TarC8E0.tmp
                        Filesize

                        181KB

                        MD5

                        4ea6026cf93ec6338144661bf1202cd1

                        SHA1

                        a1dec9044f750ad887935a01430bf49322fbdcb7

                        SHA256

                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                        SHA512

                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        2.8MB

                        MD5

                        8cbe0ced0c0f7bfbdf19128ba80adb99

                        SHA1

                        15e615a0fe64fe5200dd916232d9bc26b1c3d815

                        SHA256

                        055c34101c332838618fdedb730655f61b97553c5e56df94efd373667a3db895

                        SHA512

                        4b258260770b08fdd8f14b7bf0e703b8ca5010e4698e457bc0cfc76c246fb9e7c60ee4d2068b717f8205c2c1954d3b6b8742ed2547b67082f5b89c63d850e938

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                        Filesize

                        1.6MB

                        MD5

                        72491c7b87a7c2dd350b727444f13bb4

                        SHA1

                        1e9338d56db7ded386878eab7bb44b8934ab1bc7

                        SHA256

                        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                        SHA512

                        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                        Filesize

                        3.3MB

                        MD5

                        045b0a3d5be6f10ddf19ae6d92dfdd70

                        SHA1

                        0387715b6681d7097d372cd0005b664f76c933c7

                        SHA256

                        94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                        SHA512

                        58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                        Filesize

                        440B

                        MD5

                        3626532127e3066df98e34c3d56a1869

                        SHA1

                        5fa7102f02615afde4efd4ed091744e842c63f78

                        SHA256

                        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                        SHA512

                        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L9AKJ1ZBNQVWWUTUA8HS.temp
                        Filesize

                        7KB

                        MD5

                        0276aa12b493e0cd413c1d93fab1a83d

                        SHA1

                        9e021b5fb288debaab148ede8057e353135c9650

                        SHA256

                        52a000d6327742913daa4825dc4a2b0448bfb6ca8f369921b6edf40b619467b0

                        SHA512

                        f4b6d0a8b2b4fd1a133fdf8eb08e003e797188049ae4d09814da4fbf8d6ab4f236b87bffcf99f4b60cc895fd3803d8504348166f18a2ce3b873010bb716e29e1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                        Filesize

                        7KB

                        MD5

                        d2391870f66c87acdd253f5034bf58df

                        SHA1

                        39d08ae95083fa00845318069c454fa671c7de18

                        SHA256

                        efd7dec555ae8dfb669c7931a2e76bb5c1af380404b5678a205ae3038340e73a

                        SHA512

                        318fe377ea82c0a050896fadd5ebfb5ae6eac628c004fe1f6b2fe24747a3eb32ddfcaf03e1e04758eafc9824c7634929bc8b0c84b5f03cb2894caa6250bd82b9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        9KB

                        MD5

                        4c930031be0a9f083586d5acda2eea53

                        SHA1

                        948e12508f5aef57ddb861a831be50ef217eb753

                        SHA256

                        a205af008f2bb4be55a6d6ff6269e4fd23eb38f6eed36b3dd186efc9d2802f78

                        SHA512

                        4bd470017ad19e156573073ef9e68b1f242b61b1fc3bff680419dd7260c01167ca71f0657c05f2519527e00b78a929092803dc5f223e2598c46c0f5d3aa3af3c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\1c54aba8-9fcb-4aba-b303-88f403c4f918
                        Filesize

                        733B

                        MD5

                        ec71576bb7b4f7e60385f608ab06938a

                        SHA1

                        6fc70c0d18f292012aedb25b43781977b882ff10

                        SHA256

                        b106c8a26613f1aed29ba6bd5f97012dcf2632fcc70e31b1d51370e74a1caebd

                        SHA512

                        a1fff1f9f0961a87de2a1243da9b46f3080d531281127a5e78fa728530f0ad7bb62bab163aa5a8d9916b744fd7191e65ec67dfcf8db3b5e3696204aa2cbe635d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js
                        Filesize

                        6KB

                        MD5

                        466f072eeffaacc7430d1ec7058b26d1

                        SHA1

                        1e56c4b27832b8a36a4affa11ff54f942949c9ce

                        SHA256

                        cbe05ac2f1db9e3c7c792a105eb66753c50127197e484f381da7c8b482bb53c7

                        SHA512

                        4a37106bd75f3eaf8f01b3bc9b332bf15f765b9ac0504a151555879f94e5120f564bd3e639182435a34ac38423604c969c88d58cf617bd80378dd95cdd884025

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        fede96dec562541d99f20847a9542d3f

                        SHA1

                        9632c2a48c71c053c6a7f6e414eff71fd929ae25

                        SHA256

                        489a509a42371f0bee24c774fdf1d974719aa368201aa0d0b706d7d98fae1b14

                        SHA512

                        0ffe64e7ec96f5917e0e27776477c0301b3b836d8db22b302df811a253d7cf60158ee3782ff21e2d721b9d36f93f8059cfa6a683a23d72e3a0aecc57a13e85c9

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\main\7z.exe
                        Filesize

                        458KB

                        MD5

                        619f7135621b50fd1900ff24aade1524

                        SHA1

                        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                        SHA256

                        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                        SHA512

                        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                        Download Submit

                      • memory/304-1437-0x0000000006890000-0x0000000006D36000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/304-1457-0x0000000006890000-0x0000000006D56000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/304-3700-0x0000000006890000-0x00000000073EC000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/304-3718-0x0000000006890000-0x00000000073EC000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/304-17-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-3585-0x0000000006890000-0x0000000006D56000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/304-3584-0x0000000006890000-0x0000000006D56000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/304-18-0x0000000001031000-0x000000000105F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/304-19-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-21-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-22-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-23-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-37-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-38-0x0000000001030000-0x000000000133B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/304-1411-0x0000000006890000-0x0000000006D3B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/304-1383-0x0000000006890000-0x0000000006D3B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/304-1456-0x0000000006890000-0x0000000006D56000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/304-1384-0x0000000006890000-0x0000000006D3B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/304-1412-0x0000000006890000-0x0000000006D3B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/304-1367-0x0000000006270000-0x000000000655C000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/304-1429-0x0000000006890000-0x0000000006D36000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/304-1438-0x0000000006890000-0x0000000006D36000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/304-1356-0x0000000006270000-0x000000000655C000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/304-1431-0x0000000006890000-0x0000000006D36000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/304-1317-0x0000000006270000-0x000000000655C000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/304-1316-0x0000000006270000-0x000000000655C000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/868-4033-0x000000001B780000-0x000000001BA62000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/868-4034-0x0000000001F40000-0x0000000001F48000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/1792-57-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-61-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-59-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-63-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-65-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1792-68-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1792-70-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1972-142-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-156-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-120-0x0000000004630000-0x000000000471E000-memory.dmp

                        Filesize

                        952KB

                        Download

                      • memory/1972-138-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-136-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-119-0x00000000000D0000-0x00000000001C0000-memory.dmp

                        Filesize

                        960KB

                        Download

                      • memory/1972-1359-0x00000000054D0000-0x0000000005524000-memory.dmp

                        Filesize

                        336KB

                        Download

                      • memory/1972-126-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-134-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-130-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-1299-0x0000000001FD0000-0x0000000002030000-memory.dmp

                        Filesize

                        384KB

                        Download

                      • memory/1972-1300-0x00000000041F0000-0x000000000423C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/1972-140-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-128-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-144-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-148-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-150-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-152-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-154-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-132-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-158-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-162-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-165-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-166-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-168-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-121-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-146-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-122-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-124-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/1972-160-0x0000000004630000-0x0000000004719000-memory.dmp

                        Filesize

                        932KB

                        Download

                      • memory/2868-5-0x0000000000B30000-0x0000000000E3B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/2868-4-0x0000000000B30000-0x0000000000E3B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/2868-3-0x0000000000B30000-0x0000000000E3B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/2868-2-0x0000000000B31000-0x0000000000B5F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2868-16-0x0000000000B30000-0x0000000000E3B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/2868-0-0x0000000000B30000-0x0000000000E3B000-memory.dmp

                        Filesize

                        3.0MB

                        Download

                      • memory/2868-1-0x0000000077530000-0x0000000077532000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2984-1358-0x0000000000E20000-0x000000000110C000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/3292-3652-0x000000013F9E0000-0x000000013FE70000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/3292-3667-0x000000013F9E0000-0x000000013FE70000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/3292-3653-0x000000013F9E0000-0x000000013FE70000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/3736-1386-0x00000000000B0000-0x000000000055B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3736-1410-0x00000000000B0000-0x000000000055B000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4240-1407-0x0000000001230000-0x0000000001346000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/4240-1408-0x00000000004F0000-0x0000000000516000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/4240-1439-0x0000000005A20000-0x0000000005AE2000-memory.dmp

                        Filesize

                        776KB

                        Download

                      • memory/4404-3686-0x000000013F9E0000-0x000000013FE70000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4404-3656-0x000000013F9E0000-0x000000013FE70000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4548-3662-0x0000000001E80000-0x0000000001E88000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/4548-3661-0x000000001B840000-0x000000001BB22000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/4688-1436-0x0000000001180000-0x0000000001626000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/4688-1432-0x0000000001180000-0x0000000001626000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5156-1472-0x0000000000BC0000-0x0000000001086000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5156-1458-0x0000000000BC0000-0x0000000001086000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5400-3664-0x000000013F590000-0x000000013FA20000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5400-3666-0x000000013F590000-0x000000013FA20000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5552-3668-0x000000013F590000-0x000000013FA20000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5552-3678-0x000000013F590000-0x000000013FA20000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/5636-4012-0x00000000010A0000-0x000000000135E000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/5636-4011-0x00000000010A0000-0x000000000135E000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/5776-1490-0x0000000000E30000-0x0000000000E3C000-memory.dmp

                        Filesize

                        48KB

                        Download

                      • memory/5812-3684-0x0000000001D90000-0x0000000001D98000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/5812-3683-0x000000001B770000-0x000000001BA52000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/6080-1505-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/6080-3576-0x0000000000730000-0x000000000075C000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/6080-1507-0x0000000000D30000-0x0000000000DC8000-memory.dmp

                        Filesize

                        608KB

                        Download

                      • memory/6360-3979-0x0000000005810000-0x0000000005966000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/6360-3980-0x0000000000280000-0x00000000002A2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/6360-3773-0x0000000001130000-0x0000000001458000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/6520-3786-0x00000000012E0000-0x00000000012EC000-memory.dmp

                        Filesize

                        48KB

                        Download