amadey | 42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f

Analysis

max time kernel
33s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Size

2.9MB
MD5

b48526e3264a9ebf9ae221df76f8511e
SHA1

51141f95d23355a1891b88e470b2c9a3e44ba92e
SHA256

42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f
SHA512

ad26656d29e916e06d26de91f0da8703c1f677bd369196e282f6e1eec3a0baca504a564607b4e6f7d18b8ac350428aaff01e2f39ccc435715526daaae1a0e100
SSDEEP

49152:isilqKky+KMCXclIjF9ML4Im3AS7Vsu2yBxXQWxu58xdS:5iIKgKMCYO9ML+AS55BmWcY

Score

10^/10

amadey gcleaner lumma stealc vidar 9c9aa5 stok discovery evasion execution loader persistence stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/4964-246-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/files/0x0008000000023c07-245.dat	family_vidar_v7
behavioral2/memory/4964-341-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2905a24454.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2905a24454.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	475d0b7cbf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	549c8695b0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	160af3526b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3896	powershell.exe
1248	powershell.exe
2088	powershell.exe
5588	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2905a24454.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2905a24454.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	475d0b7cbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	549c8695b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	549c8695b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	475d0b7cbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	160af3526b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	160af3526b.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	2f56f6ee78.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	3d531812abae45a6b37dde8534daf9ba.exe

Executes dropped EXE 14 IoCs

pid	Process
3680	skotes.exe
916	dc9d4a9a99.exe
1720	dc9d4a9a99.exe
1488	2905a24454.exe
3984	skotes.exe
3668	ad7496ce8d.exe
4172	ad7496ce8d.exe
4592	e88f1a96bb.exe
4856	475d0b7cbf.exe
2788	2f56f6ee78.exe
4420	549c8695b0.exe
4964	a775e8f54e204d04b9e1389399f8a00e.exe
4524	3d531812abae45a6b37dde8534daf9ba.exe
2244	160af3526b.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	2905a24454.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	475d0b7cbf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	549c8695b0.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	160af3526b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Wine	skotes.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\549c8695b0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018186001\\549c8695b0.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
73	raw.githubusercontent.com
71	raw.githubusercontent.com
72	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023c5d-301.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
3680	skotes.exe
1488	2905a24454.exe
3984	skotes.exe
4856	475d0b7cbf.exe
4420	549c8695b0.exe
2244	160af3526b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 1720	916	dc9d4a9a99.exe	85
PID 3668 set thread context of 4172	3668	ad7496ce8d.exe	97

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3376-4443-0x00007FF70CB20000-0x00007FF70CFB0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3408	4724	WerFault.exe	151
5892	5856	WerFault.exe	150
4176	5856	WerFault.exe	150
5736	5856	WerFault.exe	150
7824	5876	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc9d4a9a99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e88f1a96bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad7496ce8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f56f6ee78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad7496ce8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	475d0b7cbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	549c8695b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a775e8f54e204d04b9e1389399f8a00e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	160af3526b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc9d4a9a99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2905a24454.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6268	powershell.exe
6628	PING.EXE
5648	powershell.exe
4400	PING.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2336	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4276	taskkill.exe
2324	taskkill.exe
4524	taskkill.exe
224	taskkill.exe
1844	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6628	PING.EXE
4400	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
3680	skotes.exe
3680	skotes.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
1488	2905a24454.exe
3984	skotes.exe
3984	skotes.exe
4592	e88f1a96bb.exe
4592	e88f1a96bb.exe
4856	475d0b7cbf.exe
4856	475d0b7cbf.exe
4592	e88f1a96bb.exe
2788	2f56f6ee78.exe
3896	powershell.exe
3896	powershell.exe
4420	549c8695b0.exe
4420	549c8695b0.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe
2244	160af3526b.exe
2244	160af3526b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	2f56f6ee78.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3680	552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe	82
PID 552 wrote to memory of 3680	552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe	82
PID 552 wrote to memory of 3680	552	42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe	82
PID 3680 wrote to memory of 916	3680	skotes.exe	83
PID 3680 wrote to memory of 916	3680	skotes.exe	83
PID 3680 wrote to memory of 916	3680	skotes.exe	83
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 916 wrote to memory of 1720	916	dc9d4a9a99.exe	85
PID 3680 wrote to memory of 1488	3680	skotes.exe	90
PID 3680 wrote to memory of 1488	3680	skotes.exe	90
PID 3680 wrote to memory of 1488	3680	skotes.exe	90
PID 3680 wrote to memory of 3668	3680	skotes.exe	93
PID 3680 wrote to memory of 3668	3680	skotes.exe	93
PID 3680 wrote to memory of 3668	3680	skotes.exe	93
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3668 wrote to memory of 4172	3668	ad7496ce8d.exe	97
PID 3680 wrote to memory of 4592	3680	skotes.exe	98
PID 3680 wrote to memory of 4592	3680	skotes.exe	98
PID 3680 wrote to memory of 4592	3680	skotes.exe	98
PID 3680 wrote to memory of 4856	3680	skotes.exe	99
PID 3680 wrote to memory of 4856	3680	skotes.exe	99
PID 3680 wrote to memory of 4856	3680	skotes.exe	99
PID 3680 wrote to memory of 2788	3680	skotes.exe	100
PID 3680 wrote to memory of 2788	3680	skotes.exe	100
PID 3680 wrote to memory of 2788	3680	skotes.exe	100
PID 2788 wrote to memory of 3896	2788	2f56f6ee78.exe	102
PID 2788 wrote to memory of 3896	2788	2f56f6ee78.exe	102
PID 2788 wrote to memory of 3896	2788	2f56f6ee78.exe	102
PID 3680 wrote to memory of 4420	3680	skotes.exe	104
PID 3680 wrote to memory of 4420	3680	skotes.exe	104
PID 3680 wrote to memory of 4420	3680	skotes.exe	104
PID 2788 wrote to memory of 1248	2788	2f56f6ee78.exe	105
PID 2788 wrote to memory of 1248	2788	2f56f6ee78.exe	105
PID 2788 wrote to memory of 1248	2788	2f56f6ee78.exe	105
PID 2788 wrote to memory of 4964	2788	2f56f6ee78.exe	108
PID 2788 wrote to memory of 4964	2788	2f56f6ee78.exe	108
PID 2788 wrote to memory of 4964	2788	2f56f6ee78.exe	108
PID 2788 wrote to memory of 4524	2788	2f56f6ee78.exe	125
PID 2788 wrote to memory of 4524	2788	2f56f6ee78.exe	125
PID 3680 wrote to memory of 2244	3680	skotes.exe	110
PID 3680 wrote to memory of 2244	3680	skotes.exe	110
PID 3680 wrote to memory of 2244	3680	skotes.exe	110

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6240	attrib.exe
6212	attrib.exe
6168	attrib.exe

C:\Users\Admin\AppData\Local\Temp\42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe
"C:\Users\Admin\AppData\Local\Temp\42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\1018180001\dc9d4a9a99.exe
    "C:\Users\Admin\AppData\Local\Temp\1018180001\dc9d4a9a99.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\1018180001\dc9d4a9a99.exe
      "C:\Users\Admin\AppData\Local\Temp\1018180001\dc9d4a9a99.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1720
- - C:\Users\Admin\AppData\Local\Temp\1018181001\2905a24454.exe
    "C:\Users\Admin\AppData\Local\Temp\1018181001\2905a24454.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\1018182001\ad7496ce8d.exe
    "C:\Users\Admin\AppData\Local\Temp\1018182001\ad7496ce8d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\1018182001\ad7496ce8d.exe
      "C:\Users\Admin\AppData\Local\Temp\1018182001\ad7496ce8d.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\1018183001\e88f1a96bb.exe
    "C:\Users\Admin\AppData\Local\Temp\1018183001\e88f1a96bb.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\1018184001\475d0b7cbf.exe
    "C:\Users\Admin\AppData\Local\Temp\1018184001\475d0b7cbf.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\1018185001\2f56f6ee78.exe
    "C:\Users\Admin\AppData\Local\Temp\1018185001\2f56f6ee78.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\vrpclubtd"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1248
  - - C:\vrpclubtd\a775e8f54e204d04b9e1389399f8a00e.exe
      "C:\vrpclubtd\a775e8f54e204d04b9e1389399f8a00e.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4964
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\vrpclubtd\a775e8f54e204d04b9e1389399f8a00e.exe" & rd /s /q "C:\ProgramData\2NGDBS2NOP8Y" & exit
        5⤵
        
        PID:2980
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:2336
  - - C:\vrpclubtd\3d531812abae45a6b37dde8534daf9ba.exe
      "C:\vrpclubtd\3d531812abae45a6b37dde8534daf9ba.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        5⤵
        
        PID:4892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xdc,0xe0,0x104,0x108,0x7ffae43546f8,0x7ffae4354708,0x7ffae4354718
        6⤵
        
        PID:2444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3654839468434241769,5270253418665135026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        6⤵
        
        PID:3804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3654839468434241769,5270253418665135026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        
        PID:1196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3654839468434241769,5270253418665135026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        6⤵
        
        PID:4852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3654839468434241769,5270253418665135026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        
        PID:1892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3654839468434241769,5270253418665135026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        6⤵
        
        PID:1624
- - C:\Users\Admin\AppData\Local\Temp\1018186001\549c8695b0.exe
    "C:\Users\Admin\AppData\Local\Temp\1018186001\549c8695b0.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\1018187001\160af3526b.exe
    "C:\Users\Admin\AppData\Local\Temp\1018187001\160af3526b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\1018188001\390be0d43a.exe
    "C:\Users\Admin\AppData\Local\Temp\1018188001\390be0d43a.exe"
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:4524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:4276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:1844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:2664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1856 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ecc8a97-4513-454f-8816-3a1efaa50ae9} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" gpu
        6⤵
        
        PID:2640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc19d4c-7938-464f-8546-1043bb43180c} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" socket
        6⤵
        
        PID:3504
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2608 -childID 1 -isForBrowser -prefsHandle 2668 -prefMapHandle 3068 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e560ed60-6b08-48aa-bd0c-b6aa17f41dfd} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" tab
        6⤵
        
        PID:3944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4008 -childID 2 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf987e6-6e52-4588-9906-b30e75bbd64b} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" tab
        6⤵
        
        PID:8
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4624 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 4600 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14dd22ee-d15d-4c0e-a7eb-6c5d26386143} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" utility
        6⤵
        
        PID:5560
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 3 -isForBrowser -prefsHandle 5488 -prefMapHandle 5484 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {041ee5ab-024d-41a6-b353-b4c74992cc12} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" tab
        6⤵
        
        PID:5792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5640 -childID 4 -isForBrowser -prefsHandle 5216 -prefMapHandle 4128 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b427c74-6c00-4605-aabf-3fff53e72498} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" tab
        6⤵
        
        PID:5804
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5892 -childID 5 -isForBrowser -prefsHandle 5812 -prefMapHandle 5816 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f3ddcc-1825-4fb1-bc20-4cd0cf05a3ab} 2664 "\\.\pipe\gecko-crash-server-pipe.2664" tab
        6⤵
        
        PID:5688
- - C:\Users\Admin\AppData\Local\Temp\1018189001\de96b9dea1.exe
    "C:\Users\Admin\AppData\Local\Temp\1018189001\de96b9dea1.exe"
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Local\Temp\1018190001\0a0046c129.exe
    "C:\Users\Admin\AppData\Local\Temp\1018190001\0a0046c129.exe"
    3⤵
    PID:5876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 640
      4⤵
      Program crash
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\1018191001\36c01f02c6.exe
    "C:\Users\Admin\AppData\Local\Temp\1018191001\36c01f02c6.exe"
    3⤵
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\1018191001\36c01f02c6.exe
      "C:\Users\Admin\AppData\Local\Temp\1018191001\36c01f02c6.exe"
      4⤵
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\1018192001\be769429a7.exe
    "C:\Users\Admin\AppData\Local\Temp\1018192001\be769429a7.exe"
    3⤵
    PID:5856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1476
      4⤵
      Program crash
      PID:4176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1424
      4⤵
      Program crash
      PID:5892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 1476
      4⤵
      Program crash
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\1018193001\943c9c4d31.exe
    "C:\Users\Admin\AppData\Local\Temp\1018193001\943c9c4d31.exe"
    3⤵
    PID:4724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 568
      4⤵
      Program crash
      PID:3408
- - C:\Users\Admin\AppData\Local\Temp\1018194001\8d2e6372d5.exe
    "C:\Users\Admin\AppData\Local\Temp\1018194001\8d2e6372d5.exe"
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\vjrkkclfov"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2088
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5588
  - - C:\vjrkkclfov\2bfd0dd70d94418c800361bbb977d959.exe
      "C:\vjrkkclfov\2bfd0dd70d94418c800361bbb977d959.exe"
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\1018195001\9f013d6166.exe
    "C:\Users\Admin\AppData\Local\Temp\1018195001\9f013d6166.exe"
    3⤵
    PID:6296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:7768
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        
        PID:1020
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        
        PID:3376
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:6212
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:6240
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6268
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6628
- - C:\Users\Admin\AppData\Local\Temp\1018196001\ac67e44fb1.exe
    "C:\Users\Admin\AppData\Local\Temp\1018196001\ac67e44fb1.exe"
    3⤵
    PID:6876
- - C:\Users\Admin\AppData\Local\Temp\1018197001\23cfde1501.exe
    "C:\Users\Admin\AppData\Local\Temp\1018197001\23cfde1501.exe"
    3⤵
    PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\1018197001\23cfde1501.exe
      "C:\Users\Admin\AppData\Local\Temp\1018197001\23cfde1501.exe"
      4⤵
      PID:5800

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4724 -ip 4724
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5856 -ip 5856
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5856 -ip 5856
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5856 -ip 5856
1⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5876 -ip 5876
1⤵
PID:7540

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:1112

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
PID:2980
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5648
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4981695b02378ba3b09842d5f524f7d6

SHA1
af99c43dc4426bfa2deac34ccb23382512f25ac9

SHA256
f88370e8385c0269e05c2303cff782cd6d5fa523b147902f173db2e47630e7ff

SHA512
fead9b076bfd4e1ef5e937e64a0b2b0e05b695c14d8614cd289d18d132de0a10fe087eb6a788a7e6ec3204753096bb22b223ae602ed450f2a643d7c83bf09239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WQOY74U4\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
bbc43aab40d721b43444b61353e2cd03

SHA1
e0316ea74b9192236b2c61a6ccc89bb276ceca90

SHA256
40de0ce5297e831e376de03bc80d463b8606abb656b5e503455bf14e01cc46d2

SHA512
79980be71630f4065d993817fe6ac52ed4c89e272bb7dc3c263c136a5c6649d6f49bbdd565cd6acf124568310160b9237cb30adbba7925d166bde0a520e103a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a4832dfb054a56b774335891c1b8cd9b

SHA1
8b02778a4200501740bd5645a73a63ba236a8a0a

SHA256
8bffbb5c17865de250700938a4ae2f8d2f47078a7f41631797dc174f8979c14e

SHA512
24bf9feaf0145454b9e16eb96ddcd96cc5bc3f200fb0a3500d601f570d67e431515f46ab010ffc3654325f79fda34647423d03348046c5c45d1cad6ee221271a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e5ead2fa43bc33e4abfbe3fb689dce4f

SHA1
af1d26100f36df22872ef1b77a9f5c21323cb6de

SHA256
2a0819ec146cc97b9eaf2e1d096b62d1db9f1d0c299a5c3bcd077c2aef562c9e

SHA512
ca59e44452e02996e5a52c10b2d1b23c5dcff4a7d75da41c599b83fdd43bf90770a2bc4130c111577c7cfcd96c05f392df2f27a0c17a27d6659334b0eb21b71d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
bc6edff659e7555c099981d693590cda

SHA1
e3482a0bc00a1baaf64420db9d2d01396c71fa36

SHA256
f0d1656170b260a6b3f36a20798fd866964aef35dfdb497f2040a0a410f9936b

SHA512
18e4fb1007788c93565811341852d491e0d438615596df65fc67793dbebbb924d8678cdc368488ef0b073e1f86096c375982eb994cbd4ff79d1ccdc1eea0d8eb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
a1900726f0f47a716fd552a9fc101e4d

SHA1
42267b83224e57bf743acde5906dc3c8f054085e

SHA256
a116fe0c9d7d8a98a7fe812fca3a17ebb9630ae9dd48717f9a8b9511f5fba19e

SHA512
3ecaa7cafd11f6572f88e22b78592a8158639309a971bb3080480ae0e4138ad1bcdf3c6e6bc1be5d98b4b3c6c83497d74336770987f67aa0332eaf625f3c50d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
83e824166ee0a078d6796c267397e8c6

SHA1
298645f724c8041558216893ed17d57f34454ec4

SHA256
32970c2c814e191b13887df5ed534c2b8f4f788bff20ed8439f53a689d8cba7b

SHA512
f417e6424b68c0c83bbe2cb08868ad980a507b1abbae7843f800dd3467e2e8a6dbcfc7dd525e8ff2da70f4b633a9cb6d75a8e5fe1eae2c863c8bbd709fcf2fae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fmsgkth.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018180001\dc9d4a9a99.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018181001\2905a24454.exe

Filesize
4.3MB

MD5
d460614a38afe39ba7ca3fe331c0de53

SHA1
d150e613032919a2a4da84c26f17bdbe5112f847

SHA256
8bff2b1dd2b8b6b4e09d448eecca556b368db5ea69581d64f7a8201e974d90ef

SHA512
cc02f6d6c4c4a5f66a9cb7fcf8c2378651d882c408492a3e3e51b9e011ac5f39148ec665d422ef7ce7ee4f9741e30fb875c77f0a8e2f4b43088cd5d43a6c3b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018182001\ad7496ce8d.exe

Filesize
791KB

MD5
e8af4d0d0b47ac68d762b7f288ae8e6e

SHA1
1d65f31526cc20ab41d6b1625d6674d7f13e326c

SHA256
b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

SHA512
80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018183001\e88f1a96bb.exe

Filesize
1.3MB

MD5
669ed3665495a4a52029ff680ec8eba9

SHA1
7785e285365a141e307931ca4c4ef00b7ecc8986

SHA256
2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

SHA512
bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018184001\475d0b7cbf.exe

Filesize
1.8MB

MD5
25fb9c54265bbacc7a055174479f0b70

SHA1
4af069a2ec874703a7e29023d23a1ada491b584e

SHA256
552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

SHA512
7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018185001\2f56f6ee78.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018186001\549c8695b0.exe

Filesize
1.8MB

MD5
f158cdb34eb5c4de5eb858cce72f94cb

SHA1
e93703e534ee3572c5134be5b316e1ae5feeb9c0

SHA256
801900fc452dc3d0f333fe3be08e78406099be541daff50b7de46f4209d54c0c

SHA512
a913c9e2f3bcd7b6016aa43838679ee3664d042c7457d97c75ed140659748f79a26c606c31c878a84207a6751111dc647292c2e7848c1a9d8c292622de16ce8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018187001\160af3526b.exe

Filesize
2.8MB

MD5
248411545685b7ff7b35c9be0067004c

SHA1
0610ead2ac9241ffd2ff1dfc334e2d0f2d1a31ca

SHA256
117b62e85dbbddf6a8dcf7c29df0195a45b46a38c4f5a6428fd6f470e2b41ea9

SHA512
6a29bf1c43c75248372fbee8119c3ce6c9dc2f607db917752e4bf696bf2be76854bcdacffccc625582b0fdedb49b0428b7b7e333e84e907f08b2f16ae343c03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018188001\390be0d43a.exe

Filesize
946KB

MD5
bd79ee3850ed9f92a322f6ea487ab0cb

SHA1
9eb884d2feda4c3959f2f6878e7813264ee5716f

SHA256
373256d6ed3677d589bf34e4718e9c83708d1285eb5d88022d673c294d5c7bb2

SHA512
dbbdb73fe1668de519aa50ac95d759ecb067ed38d812960519060a9962f2a3243f9fa8ae7b89fe2a880d6436b3474b06fb562e55f450ae8bfc95c8209244feda

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018189001\de96b9dea1.exe

Filesize
2.7MB

MD5
890d824cd79fe9a86ded6b64ed799ad7

SHA1
ad60b467cee30245b352715f4694cabe41b83470

SHA256
c34746b5895ab129dc4875e1ecb872799ac76ecda670146ccee25ef7dbf5ca44

SHA512
2dc81a856d3b0846c4b778d6c05cc183a029a88219ff42973ef1b5b3afacb629149c80abef88b9e5dc7ab5adaaf580b73e5d2eb67687bd8563587055e6e4f15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018190001\0a0046c129.exe

Filesize
1.8MB

MD5
3c2e26d10fa55af2e913120df3b7eddb

SHA1
a6ba8c6378d44616d7196331c6ea54e286136ce6

SHA256
4463effeb9799edfe6c07776f1e044718792fabb6ea103b9ee016e5efd21a985

SHA512
be0d54efddd550dd9acc996df86ff2dc86a8fb50aa84e7d018736d16e06a97c746c2a3b92f70b56773fa791fe3b6ba365d676ed7683cd8f82738b2743d2a82c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018191001\36c01f02c6.exe

Filesize
1.1MB

MD5
ef08a45833a7d881c90ded1952f96cb4

SHA1
f04aeeb63a1409bd916558d2c40fab8a5ed8168b

SHA256
33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

SHA512
74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018192001\be769429a7.exe

Filesize
1.8MB

MD5
ff279f4e5b1c6fbda804d2437c2dbdc8

SHA1
2feb3762c877a5ae3ca60eeebc37003ad0844245

SHA256
e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

SHA512
c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018193001\943c9c4d31.exe

Filesize
1.9MB

MD5
01baaf7c78e6861c97e7d5a5480e1214

SHA1
2dcd0def38f79d808e5759e84acfde351cc35b46

SHA256
d9cceb4e02a370fb262a1b1116563591df51f926e63d5e256fe8ac40cc408cea

SHA512
9c01325d724dc97620f67f4ff738f282abf50877b4ba1ba8d1f119182130b5683ee7f1150a9335eb678c16169881bb9f890b1c706883b966106adbb61feb431f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018194001\8d2e6372d5.exe

Filesize
21KB

MD5
14becdf1e2402e9aa6c2be0e6167041e

SHA1
72cbbae6878f5e06060a0038b25ede93b445f0df

SHA256
7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

SHA512
16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018195001\9f013d6166.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018196001\ac67e44fb1.exe

Filesize
4.2MB

MD5
3fbe557c7ec8409f30604b0f5e365f70

SHA1
00d9f4548c93be387f68c1b7aeedcf4c75873b60

SHA256
f4e7b423983d4606cb9a72876f57c870884b40556ab6ea3da498d69e02acacab

SHA512
802d3925592429a116f24c5a35723f030ea6fc4924dc201eb69a09bfeda57aac3e0c2246d0e213d131b888515936c31d13c03fd6c32c2d091a3ddc2437c1642d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018197001\23cfde1501.exe

Filesize
3.1MB

MD5
c00a67d527ef38dc6f49d0ad7f13b393

SHA1
7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

SHA256
12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

SHA512
9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpE196.tmp

Filesize
1KB

MD5
a10f31fa140f2608ff150125f3687920

SHA1
ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

SHA256
28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

SHA512
cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ljzd3v0.1dt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
b48526e3264a9ebf9ae221df76f8511e

SHA1
51141f95d23355a1891b88e470b2c9a3e44ba92e

SHA256
42ee113ccf756a8e8950cb81a36558e707f20f59aef11401ca08269cce065c0f

SHA512
ad26656d29e916e06d26de91f0da8703c1f677bd369196e282f6e1eec3a0baca504a564607b4e6f7d18b8ac350428aaff01e2f39ccc435715526daaae1a0e100

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

Filesize
3.3MB

MD5
cea368fc334a9aec1ecff4b15612e5b0

SHA1
493d23f72731bb570d904014ffdacbba2334ce26

SHA256
07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

SHA512
bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
3.3MB

MD5
045b0a3d5be6f10ddf19ae6d92dfdd70

SHA1
0387715b6681d7097d372cd0005b664f76c933c7

SHA256
94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

SHA512
58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin

Filesize
6KB

MD5
ad63b7437c5eabc877a2fe74c7a0ec22

SHA1
1fbe444ba8ba83279ae8b84edde95b80babdaa28

SHA256
e44a2b1aee03ca1972d5d81a52070a6f39797a4b1a8fb965fd2aad346ca0f1c9

SHA512
1f87d3faa099fa6e1e4342ea3fc3aaac1aa29118f54eeba3c650b0b8f1e0b255f43a4b0a523fd5c48d81a1888acf7d218c5ce9e593511f9ac36ba083eb17bb9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\AlternateServices.bin

Filesize
8KB

MD5
1dba3ae7371fa010691352a961b8b3c3

SHA1
0b66f27f17032f70bdee1d3e83f2c4ea2e31146e

SHA256
747b612bf2c6bb06590dd7ede943117fead1681ed239daf320e9eef874be6b9a

SHA512
742c05c09ade161adec31f6a20c501b571bbc8da263088e025e6a25aea38a2993d44e97eacb0279e562bd989b3fd1bbbcb859df7a11cd5ede889216c2820c4c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
fcaa3250e5bafb29939823bccaa98cc8

SHA1
84d38ec40bfd2b79e639d210ffec2fb1aac5b3ec

SHA256
b2ea046c09a8b4d416d1295856b162b039ef4657ed8328c9b9a898b3554ed196

SHA512
29e859c01f362b56e26576a1902acc2ddcff5e1e3e7d15889b5d32e7e5857a59650d7b9d39cbe447363f08fac6698c02ef3d4e3a5dd8e728a3626ded68b13198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e9fd027d8bb2df4c88f0ddeba3ad5ee9

SHA1
2f66fc8682a51107f58fa03feabcc5b23c45059b

SHA256
b1c2994f43a08c18704102532ddc71ad35bf1d1805bdb24780eb322c3104c5aa

SHA512
be2f76f58894264a67c220055f9331162dc3b2b84d8e85a31a85222c4a7e4aa91512b3a02a7c1fc4ac52a647f91a9b92b074bb2a2bb4e27533956e9d9689c3cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
fdfb8d2edc9f36868ef5a6a7be4dda70

SHA1
9ba6cd5afde22cd4a8d3d7d0d7748d0b2d4d0e26

SHA256
00ffea0f566c211da3383b5bea637e0931f2e872ac493b7232b0bcb4d97dd83a

SHA512
39c3d6e76f0e319040cabb045044221d8218a7f0cf12098b6384b27d5fd1894904c26f1b6fd0d53a87ac869c50306af1dc23ada669823cc1ab38c81ab3873512

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\db\data.safe.tmp

Filesize
29KB

MD5
c3dab23f257ab247d25637e5d02bec3c

SHA1
5747ce7a6382bfd2612195cd2b9c0be89a044574

SHA256
eb5fbaa4cb5a358e1c4f61a81f9d834779f95a2613fb0ba7ad8ffb4eef13f11a

SHA512
8f8300fb8f29321ac023919591d5f0e595421976960d4a8cab249d4f813091d7cebd7e54e59f531f7f9b77990f6107fea31e735aa32117013a480f23175a023f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\02a81121-072f-41c3-8052-8f39babcf059

Filesize
671B

MD5
dea209b8f11953b5b9b3c5c8f2c3b66a

SHA1
57ef4c67a2e187b7a4bc3aced3ed23f817e9b839

SHA256
7569461d860f7cf0929381cce3e5b377c17b400099b997ab8df1db0925bc31dc

SHA512
2c7dc13784af468a34b8c9dd374e6b0ed183336e5e26c79f0d6287bde31370fc0159bbd9b6e6f5ee761da14996ef869ee3fa2fcdc63b3a9449a10b9f007cb9e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\bc50ce68-7cc7-4bf0-94a9-1c2a2a41c419

Filesize
982B

MD5
6b067840a3a88f4ee289e7f24e464fa2

SHA1
8948b510d8008c51f402adaca3ec50dbf4608b7c

SHA256
4893637bdb3fda97551a401190b731cd7b94026e2760c3da429e4086224d617c

SHA512
f68447475f0ae41766814f70ed9460960c893ccdd985152a63428a8813ea0ee35f864d971c2e061dc2a000d2cbca52fc6a8a2ac47706b8779e8be1a87b3e469c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\datareporting\glean\pending_pings\cad73f40-f7ea-4f24-bd26-cd1fedac4211

Filesize
26KB

MD5
0dd7f906a65aa4b7627731b6232d4f5d

SHA1
97834765b9e68ce1a5e00cae974885c2dc2aa3df

SHA256
c0bfddb3b97d79e8047e5c5946c4f67964c1503e04114992d55cfcca4a055874

SHA512
34f8b059d0bc3c62f80a77a06697438ad20e83dc4588540807a2a9cb0690d86d4e27224448800ebd1b05a38c7a1017a31bb71c222d2cb5a315ddf16923edc82d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

Filesize
11KB

MD5
618edc4e6f45625415c4c11151d637e2

SHA1
b0f3962075f204b9f5880c4b9403dc11393e142f

SHA256
62519becc87743c4ea3b12cd35b6eedf76f3f403080b5db1113b879a0e5faba7

SHA512
7e04e7e28ccaec49c09cfb4084e3b31d183bfec81f74717e8e5b08d831bcb29dead1009e297b788fe66fe7792fc2a61758489b5a7a7a19bc51fbbbca0b45d434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

Filesize
15KB

MD5
2321810ad2cf811afc1b66cea87a425d

SHA1
a5fb1c2c7dcbf3478ade24be4e39f3851123e081

SHA256
27c56e06240b5bbe67bd1e71bdfbb5d45f364eab02afece63012b4119cf44776

SHA512
507bbbcd0510592efd34bfdb5d8e45d0738558799c24c61e51d10c11895dfad4ff88850a3297d36f1992317a9c226f2ea1e8e412b5a2ed97d9b19c35d0b48dc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs-1.js

Filesize
15KB

MD5
25b73b1d2673fa8110b985ee3ce93d61

SHA1
2bb40f0fb1b9d30a0d270d6b8882f716798c1730

SHA256
2e5dd2d860281a23a2f318f6a355a079ef15cfb4eb3b96ec19c6d2315a42bb45

SHA512
004c0bb37831ca23f6c538856acafa9fc7a11c16f80d500df9f1343647b78296998095887c5b84153605e302988e272e1f4654bc920eb1aee8a484ba1f0206d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\prefs.js

Filesize
10KB

MD5
7cc1957dfcfdeafafbfdc586be21b0e1

SHA1
11279bf509d075cbf47bd3d04d93ff173622f72b

SHA256
a4198e022b3091ffa27102170b558849fffe5934e646356305ffa7e6ab316359

SHA512
ea8bbbedb0df5710491aa8610c53b7044529a2043764433f9225878615c75ce52c5bda93117e1e3bbb7cd5828ba75057eaf1011c4d05ffacfec638a97c6ddaaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.9MB

MD5
5b820a62ef972b15b2c2f396c5690bfc

SHA1
7539bd798165d6750b76ccd414b8e94f53945852

SHA256
58f494cb40ccdfad0256a4cae897ed8f028c6c865d34bad0f47ddd92ec0adcf1

SHA512
a5029861a39eb782be44311b2fc7cfe9ceb7a44ea6d8865f36278cd91ed49b27bffebd5ddf636098d6795b9818fb4666c8286a47948a918756d6f7d0e4b802be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.9MB

MD5
bd91c5dec2c10d010d41067049dc4179

SHA1
21ea660aba8bbf7717e5193677de7e9778f13eec

SHA256
5465f242db6a171ff3ada64e4a8259a7f2d686e56666f8fe29293f2609c70425

SHA512
a20fe7bb59f289d0ef9a2bcd65a9401a0307ededee4704f1ee7c8677bc7a94c60d3003d89b82830141815695312c2c6224cf68458dff6c93494caf3b55fd7b8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fmsgkth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.9MB

MD5
a45685c105024bf411c5d7ff2820870c

SHA1
b112cb6c5b50676f6e74104e63af303a02114d0c

SHA256
910370315ba64a4121eaeaae3e38c26f7b2b2745da662508cef903c31d3ddc66

SHA512
721477ee4525a2eefc4ce9e42eb2ef0dc1c20e7e7c93eb0ba1e7d6c2043115ca9e1dd0fcc3d863dcc4f2fca4a9c24140a8526aa6a1ac09f5a1017797abba8e7e

Download Submit
C:\vjrkkclfov\2bfd0dd70d94418c800361bbb977d959.exe

Filesize
1.2MB

MD5
577cd52217da6d7163cea46bb01c107f

SHA1
82b31cc52c538238e63bdfc22d1ea306ea0b852a

SHA256
139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

SHA512
8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

Download Submit
C:\vrpclubtd\3d531812abae45a6b37dde8534daf9ba.exe

Filesize
1.0MB

MD5
971b0519b1c0461db6700610e5e9ca8e

SHA1
9a262218310f976aaf837e54b4842e53e73be088

SHA256
47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

SHA512
d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

Download Submit
C:\vrpclubtd\a775e8f54e204d04b9e1389399f8a00e.exe

Filesize
144KB

MD5
cc36e2a5a3c64941a79c31ca320e9797

SHA1
50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

SHA256
6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

SHA512
fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

Download Submit
memory/552-2-0x0000000000EA1000-0x0000000000ECF000-memory.dmp

Filesize
184KB

Download
memory/552-1-0x0000000077BD4000-0x0000000077BD6000-memory.dmp

Filesize
8KB

Download
memory/552-4-0x0000000000EA0000-0x00000000011C6000-memory.dmp

Filesize
3.1MB

Download
memory/552-17-0x0000000000EA0000-0x00000000011C6000-memory.dmp

Filesize
3.1MB

Download
memory/552-0-0x0000000000EA0000-0x00000000011C6000-memory.dmp

Filesize
3.1MB

Download
memory/552-3-0x0000000000EA0000-0x00000000011C6000-memory.dmp

Filesize
3.1MB

Download
memory/916-40-0x0000000000DE5000-0x0000000000DE6000-memory.dmp

Filesize
4KB

Download
memory/1248-215-0x000000006FD70000-0x000000006FDBC000-memory.dmp

Filesize
304KB

Download
memory/1488-134-0x0000000000920000-0x00000000015B0000-memory.dmp

Filesize
12.6MB

Download
memory/1488-119-0x0000000000920000-0x00000000015B0000-memory.dmp

Filesize
12.6MB

Download
memory/1488-61-0x0000000000920000-0x00000000015B0000-memory.dmp

Filesize
12.6MB

Download
memory/1488-102-0x0000000000920000-0x00000000015B0000-memory.dmp

Filesize
12.6MB

Download
memory/1720-44-0x0000000000DC0000-0x0000000000E81000-memory.dmp

Filesize
772KB

Download
memory/1720-38-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1720-42-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2088-998-0x0000000005820000-0x0000000005B74000-memory.dmp

Filesize
3.3MB

Download
memory/2088-1001-0x0000000006240000-0x000000000628C000-memory.dmp

Filesize
304KB

Download
memory/2088-1087-0x0000000007130000-0x00000000071D3000-memory.dmp

Filesize
652KB

Download
memory/2088-1077-0x000000006F070000-0x000000006F0BC000-memory.dmp

Filesize
304KB

Download
memory/2088-1111-0x0000000007410000-0x0000000007421000-memory.dmp

Filesize
68KB

Download
memory/2088-1130-0x0000000007450000-0x0000000007464000-memory.dmp

Filesize
80KB

Download
memory/2244-270-0x0000000000620000-0x0000000000B1D000-memory.dmp

Filesize
5.0MB

Download
memory/2244-265-0x0000000000620000-0x0000000000B1D000-memory.dmp

Filesize
5.0MB

Download
memory/2788-145-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/3376-4443-0x00007FF70CB20000-0x00007FF70CFB0000-memory.dmp

Filesize
4.6MB

Download
memory/3680-117-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-657-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-22-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-43-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-19-0x00000000002D1000-0x00000000002FF000-memory.dmp

Filesize
184KB

Download
memory/3680-20-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-62-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-788-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-18-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-971-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-21-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-45-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3680-227-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3896-160-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/3896-161-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/3896-146-0x0000000002700000-0x0000000002736000-memory.dmp

Filesize
216KB

Download
memory/3896-177-0x0000000007350000-0x000000000736A000-memory.dmp

Filesize
104KB

Download
memory/3896-199-0x0000000007590000-0x00000000075A4000-memory.dmp

Filesize
80KB

Download
memory/3896-150-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/3896-196-0x00000000075D0000-0x0000000007666000-memory.dmp

Filesize
600KB

Download
memory/3896-176-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/3896-186-0x00000000073C0000-0x00000000073CA000-memory.dmp

Filesize
40KB

Download
memory/3896-197-0x0000000007550000-0x0000000007561000-memory.dmp

Filesize
68KB

Download
memory/3896-149-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/3896-148-0x0000000005790000-0x00000000057B2000-memory.dmp

Filesize
136KB

Download
memory/3896-163-0x0000000007200000-0x0000000007232000-memory.dmp

Filesize
200KB

Download
memory/3896-147-0x0000000005110000-0x0000000005738000-memory.dmp

Filesize
6.2MB

Download
memory/3896-162-0x00000000062A0000-0x00000000062EC000-memory.dmp

Filesize
304KB

Download
memory/3896-164-0x000000006FD70000-0x000000006FDBC000-memory.dmp

Filesize
304KB

Download
memory/3896-200-0x0000000007690000-0x00000000076AA000-memory.dmp

Filesize
104KB

Download
memory/3896-174-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/3896-175-0x0000000007240000-0x00000000072E3000-memory.dmp

Filesize
652KB

Download
memory/3896-201-0x0000000007670000-0x0000000007678000-memory.dmp

Filesize
32KB

Download
memory/3896-198-0x0000000007580000-0x000000000758E000-memory.dmp

Filesize
56KB

Download
memory/3984-66-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/3984-64-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/4172-82-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4172-84-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4420-1338-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4420-774-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4420-315-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4420-195-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4420-347-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4420-831-0x00000000007A0000-0x0000000000C50000-memory.dmp

Filesize
4.7MB

Download
memory/4524-288-0x0000023A51270000-0x0000023A512A8000-memory.dmp

Filesize
224KB

Download
memory/4524-287-0x0000023A4E9E0000-0x0000023A4E9E8000-memory.dmp

Filesize
32KB

Download
memory/4524-285-0x0000023A4E190000-0x0000023A4E1A2000-memory.dmp

Filesize
72KB

Download
memory/4524-259-0x0000023A321A0000-0x0000023A322A2000-memory.dmp

Filesize
1.0MB

Download
memory/4524-286-0x0000023A4E1F0000-0x0000023A4E22C000-memory.dmp

Filesize
240KB

Download
memory/4524-289-0x0000023A50E00000-0x0000023A50E0E000-memory.dmp

Filesize
56KB

Download
memory/4524-316-0x0000023A520D0000-0x0000023A520F6000-memory.dmp

Filesize
152KB

Download
memory/4524-267-0x0000023A33F80000-0x0000023A33F8A000-memory.dmp

Filesize
40KB

Download
memory/4524-268-0x0000023A4E890000-0x0000023A4E94A000-memory.dmp

Filesize
744KB

Download
memory/4524-290-0x0000023A51F10000-0x0000023A52096000-memory.dmp

Filesize
1.5MB

Download
memory/4592-193-0x0000000000500000-0x0000000000657000-memory.dmp

Filesize
1.3MB

Download
memory/4592-121-0x0000000000930000-0x0000000000986000-memory.dmp

Filesize
344KB

Download
memory/4668-878-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/4724-838-0x00007FFB0C970000-0x00007FFB0CB65000-memory.dmp

Filesize
2.0MB

Download
memory/4724-847-0x0000000000440000-0x0000000000910000-memory.dmp

Filesize
4.8MB

Download
memory/4724-840-0x0000000076FF0000-0x0000000077205000-memory.dmp

Filesize
2.1MB

Download
memory/4724-832-0x0000000004E30000-0x0000000005230000-memory.dmp

Filesize
4.0MB

Download
memory/4724-830-0x0000000000440000-0x0000000000910000-memory.dmp

Filesize
4.8MB

Download
memory/4724-837-0x0000000004E30000-0x0000000005230000-memory.dmp

Filesize
4.0MB

Download
memory/4856-972-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4856-229-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4856-228-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4856-789-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4856-694-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4856-120-0x0000000000B70000-0x000000000101B000-memory.dmp

Filesize
4.7MB

Download
memory/4912-3989-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/4912-3926-0x00000000002D0000-0x00000000005F6000-memory.dmp

Filesize
3.1MB

Download
memory/4964-246-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/4964-341-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/5588-1216-0x0000000007490000-0x00000000074A1000-memory.dmp

Filesize
68KB

Download
memory/5588-1152-0x00000000058D0000-0x0000000005C24000-memory.dmp

Filesize
3.3MB

Download
memory/5588-1187-0x000000006F080000-0x000000006F0CC000-memory.dmp

Filesize
304KB

Download
memory/5588-1205-0x00000000071C0000-0x0000000007263000-memory.dmp

Filesize
652KB

Download
memory/5588-1166-0x00000000064D0000-0x000000000651C000-memory.dmp

Filesize
304KB

Download
memory/5588-1218-0x00000000074C0000-0x00000000074D4000-memory.dmp

Filesize
80KB

Download
memory/5656-1403-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5656-3694-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/5656-3634-0x00000000051B0000-0x0000000005242000-memory.dmp

Filesize
584KB

Download
memory/5656-3597-0x0000000005040000-0x000000000508C000-memory.dmp

Filesize
304KB

Download
memory/5656-1416-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1426-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1425-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1422-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1420-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1418-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1414-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1413-0x0000000004E90000-0x0000000004F21000-memory.dmp

Filesize
580KB

Download
memory/5656-1404-0x0000000004E90000-0x0000000004F28000-memory.dmp

Filesize
608KB

Download
memory/5656-3594-0x0000000004FB0000-0x0000000004FDC000-memory.dmp

Filesize
176KB

Download
memory/5660-4433-0x0000000000BE0000-0x0000000000F9B000-memory.dmp

Filesize
3.7MB

Download
memory/5660-1339-0x0000000000BE0000-0x0000000000F9B000-memory.dmp

Filesize
3.7MB

Download
memory/5736-841-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/5736-846-0x0000000076FF0000-0x0000000077205000-memory.dmp

Filesize
2.1MB

Download
memory/5736-844-0x00007FFB0C970000-0x00007FFB0CB65000-memory.dmp

Filesize
2.0MB

Download
memory/5736-843-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/5856-2524-0x0000000000D40000-0x00000000011E6000-memory.dmp

Filesize
4.6MB

Download
memory/5856-805-0x0000000000D40000-0x00000000011E6000-memory.dmp

Filesize
4.6MB

Download
memory/5856-974-0x0000000000D40000-0x00000000011E6000-memory.dmp

Filesize
4.6MB

Download
memory/5876-771-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/5876-807-0x0000000000400000-0x0000000000C5B000-memory.dmp

Filesize
8.4MB

Download
memory/5876-1169-0x0000000000400000-0x0000000000C5B000-memory.dmp

Filesize
8.4MB

Download
memory/5876-736-0x0000000000400000-0x0000000000C5B000-memory.dmp

Filesize
8.4MB

Download
memory/5876-808-0x0000000000400000-0x0000000000C5B000-memory.dmp

Filesize
8.4MB

Download
memory/5876-4372-0x0000000000400000-0x0000000000C5B000-memory.dmp

Filesize
8.4MB

Download
memory/5888-787-0x0000000000720000-0x00000000009D6000-memory.dmp

Filesize
2.7MB

Download
memory/5888-776-0x0000000000720000-0x00000000009D6000-memory.dmp

Filesize
2.7MB

Download
memory/5888-654-0x0000000000720000-0x00000000009D6000-memory.dmp

Filesize
2.7MB

Download
memory/5888-656-0x0000000000720000-0x00000000009D6000-memory.dmp

Filesize
2.7MB

Download
memory/5888-620-0x0000000000720000-0x00000000009D6000-memory.dmp

Filesize
2.7MB

Download