Overview

overview

10

Static

static

3

ab3fcb84f4...4c.exe

windows7-x64

10

ab3fcb84f4...4c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 12:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab3fcb84f4c0d74438e53e432978cbd7876e8dbb7bb54c6208d23becd3ea7b4c.exe

  • Size

    1.8MB

  • MD5

    cc25b82161c253d79a731c4ece950e9e

  • SHA1

    646da450ff3af5cd72bd84603ba8198ad78b6c55

  • SHA256

    ab3fcb84f4c0d74438e53e432978cbd7876e8dbb7bb54c6208d23becd3ea7b4c

  • SHA512

    923ac16d25a602bb44dd4f2f3436a1a80beb71f888d684ce2d3a02a89a7feb7bed9fb4939fb8f0b4be4fc506c62a2cf29104c6f68a72f0537a78c783821b72d0

  • SSDEEP

    49152:BXfHVpfKeVf5JU7CWkzXTyHLei+cqK+Y:tVpfKkf47CWmTyHiiXG

Score
10/10
amadeygcleanerlummastealc9c9aa5fed3aastokcredential_accessdiscoveryevasionexecutionloaderpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 28 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 40 IoCs
  • Identifies Wine through registry keys 2 TTPs 14 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab3fcb84f4c0d74438e53e432978cbd7876e8dbb7bb54c6208d23becd3ea7b4c.exe
    "C:\Users\Admin\AppData\Local\Temp\ab3fcb84f4c0d74438e53e432978cbd7876e8dbb7bb54c6208d23becd3ea7b4c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\1007888001\2703b75979.exe
        "C:\Users\Admin\AppData\Local\Temp\1007888001\2703b75979.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2104
      • C:\Users\Admin\AppData\Local\Temp\1007889001\da497f1ddf.exe
        "C:\Users\Admin\AppData\Local\Temp\1007889001\da497f1ddf.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:912
          • C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe
            "C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2724
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2724 -s 80
              6⤵
              • Loads dropped DLL
              PID:2400
          • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
            "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2972
            • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
              "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
              6⤵
              • Executes dropped EXE
              PID:2900
            • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
              "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
              6⤵
              • Executes dropped EXE
              PID:2920
            • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
              "C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:808
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 108
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2968
          • C:\Users\Admin\AppData\Local\Temp\1019360001\212761ee89.exe
            "C:\Users\Admin\AppData\Local\Temp\1019360001\212761ee89.exe"
            5⤵
            • Executes dropped EXE
            PID:1100
          • C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe
            "C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1084
            • C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe
              "C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe"
              6⤵
              • Executes dropped EXE
              PID:2004
            • C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe
              "C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:2156
          • C:\Users\Admin\AppData\Local\Temp\1019363001\356dd75ec9.exe
            "C:\Users\Admin\AppData\Local\Temp\1019363001\356dd75ec9.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:2788
            • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
              "C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2892
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\clip64.dll, Main
                7⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1516
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2952
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main
                  8⤵
                  • Blocklisted process makes network request
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1376
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    9⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:2044
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\290804112282_Desktop.zip' -CompressionLevel Optimal
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2992
          • C:\Users\Admin\AppData\Local\Temp\1019364001\563bfb4d4c.exe
            "C:\Users\Admin\AppData\Local\Temp\1019364001\563bfb4d4c.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:304
            • C:\Program Files\Windows Media Player\graph\graph.exe
              "C:\Program Files\Windows Media Player\graph\graph.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1544
          • C:\Users\Admin\AppData\Local\Temp\1019365001\e7ea1c91df.exe
            "C:\Users\Admin\AppData\Local\Temp\1019365001\e7ea1c91df.exe"
            5⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2880
          • C:\Users\Admin\AppData\Local\Temp\1019366001\ebbc826b1f.exe
            "C:\Users\Admin\AppData\Local\Temp\1019366001\ebbc826b1f.exe"
            5⤵
            • Executes dropped EXE
            PID:2952
          • C:\Users\Admin\AppData\Local\Temp\1019367001\d4059b57af.exe
            "C:\Users\Admin\AppData\Local\Temp\1019367001\d4059b57af.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2972
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\osvzzwpsqw"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2528
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1580
          • C:\Users\Admin\AppData\Local\Temp\1019368001\a34f7b0518.exe
            "C:\Users\Admin\AppData\Local\Temp\1019368001\a34f7b0518.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2212
          • C:\Users\Admin\AppData\Local\Temp\1019369001\c80fb44be7.exe
            "C:\Users\Admin\AppData\Local\Temp\1019369001\c80fb44be7.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1860
          • C:\Users\Admin\AppData\Local\Temp\1019370001\dbb4176487.exe
            "C:\Users\Admin\AppData\Local\Temp\1019370001\dbb4176487.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2908
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              6⤵
              • Loads dropped DLL
              PID:1788
              • C:\Windows\system32\mode.com
                mode 65,10
                7⤵
                  PID:280
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2352
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_7.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1712
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_6.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2732
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_5.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2208
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_4.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1780
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_3.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2212
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_2.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2436
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_1.zip -oextracted
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1804
                • C:\Windows\system32\attrib.exe
                  attrib +H "in.exe"
                  7⤵
                  • Views/modifies file attributes
                  PID:864
                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                  "in.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2136
                  • C:\Windows\system32\attrib.exe
                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    8⤵
                    • Views/modifies file attributes
                    PID:2708
                  • C:\Windows\system32\attrib.exe
                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    8⤵
                    • Views/modifies file attributes
                    PID:2740
                  • C:\Windows\system32\schtasks.exe
                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                    8⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2580
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell ping 127.0.0.1; del in.exe
                    8⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1716
                    • C:\Windows\system32\PING.EXE
                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                      9⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:2820
            • C:\Users\Admin\AppData\Local\Temp\1019371001\53d1a22ff0.exe
              "C:\Users\Admin\AppData\Local\Temp\1019371001\53d1a22ff0.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1500
            • C:\Users\Admin\AppData\Local\Temp\1019372001\ffc4bfd2cc.exe
              "C:\Users\Admin\AppData\Local\Temp\1019372001\ffc4bfd2cc.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2204
            • C:\Users\Admin\AppData\Local\Temp\1019373001\b633aeca4e.exe
              "C:\Users\Admin\AppData\Local\Temp\1019373001\b633aeca4e.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2316
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2252
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2732
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1988
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2352
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2076
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                6⤵
                  PID:1580
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    7⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2952
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.0.750670501\1438711150" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {951ad92a-5fbd-4363-ab96-8148d5675a1e} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1316 107d7458 gpu
                      8⤵
                        PID:3060
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.1.210300572\1765557118" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02db75a8-6d6a-4bc2-8452-375c2d523d65} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1524 f5eb858 socket
                        8⤵
                          PID:2980
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.2.519562123\1232427141" -childID 1 -isForBrowser -prefsHandle 1936 -prefMapHandle 1932 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dbaf1e4-ecca-4fde-a65a-0fd54c6c5e20} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1948 10763858 tab
                          8⤵
                            PID:2280
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.3.1456604302\1497119527" -childID 2 -isForBrowser -prefsHandle 2688 -prefMapHandle 2684 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b959174-471a-4220-a916-9697f7cf8a43} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 2700 d64858 tab
                            8⤵
                              PID:3076
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.4.688751371\1347930515" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3792 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d710683-bb6d-432b-acb9-c8a8c3b68715} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 3808 1e39bf58 tab
                              8⤵
                                PID:3764
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.5.483053223\1578255102" -childID 4 -isForBrowser -prefsHandle 3920 -prefMapHandle 3924 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {deccf016-c0fc-48c1-94ef-f09f9f6c9c18} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 3908 1e399858 tab
                                8⤵
                                  PID:3772
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.6.729530391\480397126" -childID 5 -isForBrowser -prefsHandle 4104 -prefMapHandle 4108 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72fab782-9b57-4b51-ac5b-e50c5ea017ff} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 4088 1e39c858 tab
                                  8⤵
                                    PID:3792
                            • C:\Users\Admin\AppData\Local\Temp\1019374001\6e5fd4b88c.exe
                              "C:\Users\Admin\AppData\Local\Temp\1019374001\6e5fd4b88c.exe"
                              5⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:680
                            • C:\Users\Admin\AppData\Local\Temp\1019375001\24a80e7de1.exe
                              "C:\Users\Admin\AppData\Local\Temp\1019375001\24a80e7de1.exe"
                              5⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:3288
                        • C:\Users\Admin\AppData\Local\Temp\1007890001\e5171b6cb8.exe
                          "C:\Users\Admin\AppData\Local\Temp\1007890001\e5171b6cb8.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Loads dropped DLL
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2948
                        • C:\Users\Admin\AppData\Local\Temp\1007891001\fbb695e6a6.exe
                          "C:\Users\Admin\AppData\Local\Temp\1007891001\fbb695e6a6.exe"
                          3⤵
                          • Enumerates VirtualBox registry keys
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1888
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {8875F38F-40E6-4F3D-A8CA-621F130067D4} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
                      1⤵
                        PID:1752
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:2088
                          • C:\Windows\explorer.exe
                            explorer.exe
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3700
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            3⤵
                            • Drops file in System32 directory
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3588
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2656

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Credentials in Registry

                      1
                      T1552.002

                      Discovery

                      Query Registry

                      7
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      2
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\Windows Media Player\graph\graph.exe
                        Filesize

                        245KB

                        MD5

                        7d254439af7b1caaa765420bea7fbd3f

                        SHA1

                        7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

                        SHA256

                        d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

                        SHA512

                        c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        Filesize

                        342B

                        MD5

                        e66b956b198b238a4fea1ba3bd6d19c9

                        SHA1

                        58af4e8c6b37fdd4d4d55a5fa3c5f4386f051a0a

                        SHA256

                        e62f7686797137b6ee876fa3e72e59c4d08c843dbe6ee4a796c43ae478ef6e27

                        SHA512

                        d79600b3952f5f6f60bf41677044671767bed14450ff109cb807541cad04c652a0bb4355a5a613d93a4362e9061d43ff612838a617f492aa4c15b727f147a576

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\download[1].htm
                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007888001\2703b75979.exe
                        Filesize

                        2.8MB

                        MD5

                        6573693c2c60cf961bccc52212548798

                        SHA1

                        2feebb1fa6bb01383984b487e81a2ea95a30dd46

                        SHA256

                        69d63576968a32f9c76ca14bbf10993300fe50799a396f87ca58612c8838ef2f

                        SHA512

                        8da5314aef5c69193589a49db2eeb8853c4ac1acabb823ec4be0acc4b9683b4e8c4c686dff134c44a8191008c5b6dbf1484b163a418e1f160524927afe6bd420

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007889001\da497f1ddf.exe
                        Filesize

                        3.0MB

                        MD5

                        7dc7a8d2e9d44cae10b9b55b65585ddc

                        SHA1

                        3e78d38a9ce837926831ea27a0efb1a262877334

                        SHA256

                        efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0

                        SHA512

                        e33388557fcea27a9d5be98eb2dc308be8d5d8d3afcb0e27d8834a96c95ba41f97c47f59de8227fd13667e8692e9063162b1d60a84161f57e4f8905f6d6483fe

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007890001\e5171b6cb8.exe
                        Filesize

                        1.8MB

                        MD5

                        7d259326e9642c8a13d30573dafe3d90

                        SHA1

                        fc5ba1d2215d2785b5223f501ce0254973adad2c

                        SHA256

                        cb6b4bb0b3fc19a3626bd33f40f4399e667db405f4ac56b69b2b271816df371b

                        SHA512

                        ddb2e84a2f3e88eda5f4c847a7bb836fc7eff26d6d47d5e74bc27180f6f346b78cb5d4aa35040b6be0f24e53651024ea59a9623f83c939762ccc216a567e4fbb

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1007891001\fbb695e6a6.exe
                        Filesize

                        4.2MB

                        MD5

                        4a09a81ebf7bee536d365270fcb2f9ac

                        SHA1

                        5d6388be06c33c95a80c35f960394eda8baf603e

                        SHA256

                        05fd14fc6511ac0a2c1460c5a17470ae35993174bbcbe7e8d0e9a36ca148aa66

                        SHA512

                        8bf24c9d3c18930fd0d0f83a6ab28204ebe178119b36c1034d0e594040eedba5849769a078ebd82dccc0624b2cc3cd3815c5a928bdf34ef6c4da79d422a4f7ad

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019345001\0KGPkVX.exe
                        Filesize

                        8.7MB

                        MD5

                        1c848c274240a7b5561550c4867c336f

                        SHA1

                        fe286e578f0652077cd858850939a152835dcc6c

                        SHA256

                        8b5af8709908fa9da7792816d03feb6287ded45a9cb5a5afd4f061113638a092

                        SHA512

                        7d96fd7398ce1a3199ea4cb0c7bc4e0f7b76692d9200dd27499b3f96e50a0b91cc77169ad542be46c74fc09e13a84597d180c4c4f0fd23ce45e8c3fa99c8042d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019352001\im2o0Q8.exe
                        Filesize

                        547KB

                        MD5

                        629e0445cca493cea47794cff619590b

                        SHA1

                        e8bf162d61546eb3b7614ee46c9dab6eaf7fffcb

                        SHA256

                        bcf7143ec01d5652ee1cb3ec07f526ba0e2a628e767869033843e5efc8e4ec5f

                        SHA512

                        726b9d06e1c8368e2bd3438829a7fbcb9e387e1c8528c4cec24ace642643d576b4db8a4f5076fa82653aa30c6559f846eb3e2b70fdee877464c8692fc43aa3bf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019360001\212761ee89.exe
                        Filesize

                        2.5MB

                        MD5

                        87330f1877c33a5a6203c49075223b16

                        SHA1

                        55b64ee8b2d1302581ab1978e9588191e4e62f81

                        SHA256

                        98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

                        SHA512

                        7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019361001\d452f661b8.exe
                        Filesize

                        758KB

                        MD5

                        afd936e441bf5cbdb858e96833cc6ed3

                        SHA1

                        3491edd8c7caf9ae169e21fb58bccd29d95aefef

                        SHA256

                        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                        SHA512

                        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019363001\356dd75ec9.exe
                        Filesize

                        429KB

                        MD5

                        51ff79b406cb223dd49dd4c947ec97b0

                        SHA1

                        b9b0253480a1b6cbdd673383320fecae5efb3dce

                        SHA256

                        2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e

                        SHA512

                        c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019364001\563bfb4d4c.exe
                        Filesize

                        591KB

                        MD5

                        3567cb15156760b2f111512ffdbc1451

                        SHA1

                        2fdb1f235fc5a9a32477dab4220ece5fda1539d4

                        SHA256

                        0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

                        SHA512

                        e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019365001\e7ea1c91df.exe
                        Filesize

                        4.3MB

                        MD5

                        49fc187b211896a8d43fb7f54686b072

                        SHA1

                        202fbb9b53023f6c3c101a871e716a35ee06f69d

                        SHA256

                        529c63741b376355bc8cd10c2d28279719e2167474d02272fb365d3f1f536129

                        SHA512

                        d58b50d743d52ccb09f1a41d651258ad6648099b24de63c5e416669afefa26d685bf2ab1cc80d693753f32ba2ecffd25334d1bc360b7d7adf0ac442c78a37acf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019366001\ebbc826b1f.exe
                        Filesize

                        1.3MB

                        MD5

                        669ed3665495a4a52029ff680ec8eba9

                        SHA1

                        7785e285365a141e307931ca4c4ef00b7ecc8986

                        SHA256

                        2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                        SHA512

                        bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019367001\d4059b57af.exe
                        Filesize

                        21KB

                        MD5

                        04f57c6fb2b2cd8dcc4b38e4a93d4366

                        SHA1

                        61770495aa18d480f70b654d1f57998e5bd8c885

                        SHA256

                        51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                        SHA512

                        53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019370001\dbb4176487.exe
                        Filesize

                        4.2MB

                        MD5

                        3a425626cbd40345f5b8dddd6b2b9efa

                        SHA1

                        7b50e108e293e54c15dce816552356f424eea97a

                        SHA256

                        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                        SHA512

                        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019371001\53d1a22ff0.exe
                        Filesize

                        1.8MB

                        MD5

                        bf56486b61f1a99182f133ac8a3937e6

                        SHA1

                        36df5535aa7ac556ae518109824e06c99ea99245

                        SHA256

                        5fd0d95b773360005ba3a149d3f63e3998be1c1b78e91d17d03c79d2168bbb1e

                        SHA512

                        45e3b6019f707bc53408fe1862df69446ed5be8934df97d0d92d6339ad55e9f4a8affbb831ee12305d4c9bed3098b3816f5fd450f70f1c2e1d0dff5ca34b05f5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019373001\b633aeca4e.exe
                        Filesize

                        947KB

                        MD5

                        fd7aa6a3eb85d4e29403d5ec15d19029

                        SHA1

                        934a72f6f8c67d220cba9cf9940318fde2794337

                        SHA256

                        f6d1fc23858d2ea98530a86f79a6d21c28602af0d38aa2b14a8d6dfdbdf290e1

                        SHA512

                        6f3d1febc8c1b5931edc322530989e4198db8b0de592c741e1814ea315ea96ff4f02af485a89a945a32f0fa393050644f2453c1be9b6d53c65d78e3bd05a5f59

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019374001\6e5fd4b88c.exe
                        Filesize

                        2.6MB

                        MD5

                        46dfc30934fdf5265bb94682c9df6cef

                        SHA1

                        7b795842a8307a310b3175efea0091feda29b44a

                        SHA256

                        04253ef0c2e4aa2b6a05a0e69eb0e01ed1c0052479febfa94c50c938e1fb15fd

                        SHA512

                        711a760332345511faa0e4dcd478e7b075ef8f9f2423a82d4961623cae8dab3c094d3092f06056778c2b984f6bfc9308370202c3085de98531f7a197b7537f7c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1019375001\24a80e7de1.exe
                        Filesize

                        1.8MB

                        MD5

                        15709eba2afaf7cc0a86ce0abf8e53f1

                        SHA1

                        238ebf0d386ecf0e56d0ddb60faca0ea61939bb6

                        SHA256

                        10bff40a9d960d0be3cc81b074a748764d7871208f324de26d365b1f8ea3935a

                        SHA512

                        65edefa20f0bb35bee837951ccd427b94a18528c6e84de222b1aa0af380135491bb29a049009f77e66fcd2abe5376a831d98e39055e1042ccee889321b96e8e9

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\290804112282
                        Filesize

                        66KB

                        MD5

                        78d90acb33c840ad7efa60e557593d2f

                        SHA1

                        de72d6924fe3ca682be23bb65c9ea76a7e459b99

                        SHA256

                        cab4d0ddc67f814f54992c22fa0305111942c47c5286f42620519ccf6836c413

                        SHA512

                        15b8a0a73ee2283a307c7da672df3bf1ced79ccedf0c31797c22ed74ac3c6729c0e27bdaba210565835ec34a1a0f9b5cb56f1881140b29575a6f865e6bde9e52

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Cab677C.tmp
                        Filesize

                        70KB

                        MD5

                        49aebf8cbd62d92ac215b2923fb1b9f5

                        SHA1

                        1723be06719828dda65ad804298d0431f6aff976

                        SHA256

                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                        SHA512

                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Tar681B.tmp
                        Filesize

                        181KB

                        MD5

                        4ea6026cf93ec6338144661bf1202cd1

                        SHA1

                        a1dec9044f750ad887935a01430bf49322fbdcb7

                        SHA256

                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                        SHA512

                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                        Filesize

                        458KB

                        MD5

                        619f7135621b50fd1900ff24aade1524

                        SHA1

                        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                        SHA256

                        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                        SHA512

                        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                        Filesize

                        440B

                        MD5

                        3626532127e3066df98e34c3d56a1869

                        SHA1

                        5fa7102f02615afde4efd4ed091744e842c63f78

                        SHA256

                        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                        SHA512

                        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\clip64.dll
                        Filesize

                        124KB

                        MD5

                        7fe5b933ed9391ea24647479c80e904e

                        SHA1

                        963721e46b8056e2e883c598e95d7daa7bdf8d9b

                        SHA256

                        2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3

                        SHA512

                        82d92d0c5155fff5ce97099cb9e78422ff328e0c516fbab7634e624215366c2191ec6ff6fe8d939268275c6770accb208af7ac69c3cc13c9188a49ef41339bb0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll
                        Filesize

                        1.2MB

                        MD5

                        d862c12a4467ebae581a8c0cc3ea2211

                        SHA1

                        9e797375b9b4422b2314d3e372628643ccf1c5db

                        SHA256

                        47f8a270b27c18bab9013f4a8f0ee6e877e4050bd4018d682eb502bcfd5bff6d

                        SHA512

                        cf6545df4a244bb7dc699a565759f97c759ba19bcc9ad9ad91a20cd07aee19cbe10eb82dd21416b717581b34dc4f24ba6d43a00e7d8018b8be133dbbc9e8113c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PMHGOYFRJTSX2P6BFJJW.temp
                        Filesize

                        7KB

                        MD5

                        0ade4d072bfc1c8c9eceb0c956404e22

                        SHA1

                        451e82dfc9ef235975aabc079eec15bc2d651e08

                        SHA256

                        d59dfae53682cf839bc4bbbadc3e9939b5e9cb223a89111c0ba13c9a1d0d641f

                        SHA512

                        3b287053b7e00179c4a6b1553280f427fd01e9059ba5f3de83236751282351795891f94b6ecfb5362a7ab3f14cacd107a8c0fbe8dceb12b2650aebb21e2b5d06

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\583a6596-a3ee-49b0-b13b-20188f2c830b
                        Filesize

                        11KB

                        MD5

                        3a610530a39a0cec927ce187e4f17523

                        SHA1

                        3392e1cbd36527c76dd976da58646270ee4757e4

                        SHA256

                        63e9e7b34c254ea988dd9e9571892b0e61d83fd3a600d175aa97dad56b6233b0

                        SHA512

                        7b52d9861460367fb7c6ab549cf87166cf22df7f38be49e67304df633bd800911dc370ff4d102d88bf27035fa95a63a6b6357ad44e5969c50d4b177f648c1aaf

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\d8f547b3-2c53-44b2-833d-fa8d1068966b
                        Filesize

                        745B

                        MD5

                        f962ed6a333986bc29a778306f0a8a8c

                        SHA1

                        0c9b7251aaa86f770046b05f5bf585cc4ff24ecc

                        SHA256

                        868f10d30f0f76112d51414fe19a92837db3c6b701494f3b8390fdf71ac52ae3

                        SHA512

                        741f569503da5a4160fa024a1de0d1787fc995f61539823cd09f1634ef0fbc55ca86afb2bf5f46599ef5a9de7688e493f03d94893372ce475f0766b816af4183

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
                        Filesize

                        7KB

                        MD5

                        08ad6c7b6675388f998bd3aa5dc08c3c

                        SHA1

                        6829a43badc9cb5d43797f6f05c47579641cdf00

                        SHA256

                        68de3c6b5eeead37019df6672bd32d39294c31744feaecdd802ea5083f42aa85

                        SHA512

                        fd0f7866cf5b40772c42c462d3b9ac8d06d564ab0ae37be20d161ba9c44923e2540eb3b7c585a7bb2b05bbda3578f5e3be1cac670f7ac34621d127dff9843282

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        06da6d17dbfb9f33b6c512ad96f49e5c

                        SHA1

                        20fb4bb48ae72b539cb03c5ab874bcc48003e612

                        SHA256

                        0971c02acc0e8990031fd675b6c3c219ed3c5a993a26949765a931b94da7e4ec

                        SHA512

                        aff3d274c0f93b3c85a38cc1c4b01e9094f91f2cf82c1f93ec84c1b55a289601b756da46fa09952bc07edb6415233b926ffb0798caabf05820b501990434e1d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                        Filesize

                        7KB

                        MD5

                        6433a3c6f887696950e1d005dfe72a1f

                        SHA1

                        cb7e30f9ab6ac53f56a2908fc1065718a276296e

                        SHA256

                        4962591bcba2f23b25c28af5025e05c00e12503f7f986bd523743c5ce36c33cb

                        SHA512

                        1333fa8291d7172f226d30a00fde16593c6f88246a4b7023f0b187ddc4ce7df11f2b6ed1778b0988ad1a957ce5b342fb55c68fbdc5e855450144e54529dab77f

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        1ceaf4d7529a4772f51c45f9c4c7d98f

                        SHA1

                        7a86031b8f4b7b8c432e745c294f148974695f33

                        SHA256

                        19fa7b684c663018b8e7dc85fde055f7afa3532b4c403ad60f407d72b9ec1501

                        SHA512

                        604da21fa12e80e331b175df2ec884ec81545dc1c8c192de5b2c48a09813b6f003f09e1bede1a67071bcaab81cf9d60c3b8a56dd0d6ff844acf8f420b4531939

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        601c9bbf9b7cf22f1f8da0b640b589de

                        SHA1

                        733199d52a9f23263efb8a167b0f211c6f3ef66a

                        SHA256

                        af24b1c0aaa497c744566b3bd82bed4348edc0cf7640decb08394b53614e7e63

                        SHA512

                        bb5d486abf2eda2eea13e65707b0e5b71d2f9b47ed3fc13f79bfcb87610333d23a0d5f2be0061c83dad1decd12e62e347364d59f5fd96be79e6fdbbdd6e26a9c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        4KB

                        MD5

                        2e9da090413d1af367c90e7a26443d0a

                        SHA1

                        e0ef0fb3368ed03ef7b0215f1f7f22c0713d6bc9

                        SHA256

                        bb8d51004ec1fba76ebaa3dfb9d15aee434208424d1d7a72f4f967b180eebb82

                        SHA512

                        2ca9bd3b59aa601fac07785f1fe99290493f8c7280d6965e96b28196dfc81157f609054cf9af123c9c96013dae093d813fba02fcc96204d4d59695cc694117de

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\2f2Se5CW3\Y-Cleaner.exe
                        Filesize

                        1.4MB

                        MD5

                        a8cf5621811f7fac55cfe8cb3fa6b9f6

                        SHA1

                        121356839e8138a03141f5f5856936a85bd2a474

                        SHA256

                        614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                        SHA512

                        4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        Filesize

                        1.8MB

                        MD5

                        cc25b82161c253d79a731c4ece950e9e

                        SHA1

                        646da450ff3af5cd72bd84603ba8198ad78b6c55

                        SHA256

                        ab3fcb84f4c0d74438e53e432978cbd7876e8dbb7bb54c6208d23becd3ea7b4c

                        SHA512

                        923ac16d25a602bb44dd4f2f3436a1a80beb71f888d684ce2d3a02a89a7feb7bed9fb4939fb8f0b4be4fc506c62a2cf29104c6f68a72f0537a78c783821b72d0

                        Download Submit

                      • memory/680-614-0x00000000001D0000-0x000000000047E000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/680-613-0x00000000001D0000-0x000000000047E000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/744-63-0x0000000000DD0000-0x00000000010DD000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/744-77-0x0000000000DD0000-0x00000000010DD000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/808-172-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-176-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-174-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-170-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-185-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-180-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-182-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/808-178-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/808-183-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/912-397-0x0000000006C50000-0x00000000078DE000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/912-142-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-213-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-460-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-448-0x0000000006C50000-0x00000000078DE000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/912-116-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-325-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-578-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-410-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/912-75-0x0000000001180000-0x000000000148D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1716-530-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/1716-531-0x00000000022C0000-0x00000000022C8000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/1860-547-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/1888-286-0x0000000000F30000-0x0000000001BA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/1888-113-0x0000000000F30000-0x0000000001BA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/1888-194-0x0000000000F30000-0x0000000001BA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/1888-195-0x0000000000F30000-0x0000000001BA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/1888-361-0x0000000000F30000-0x0000000001BA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/2104-47-0x0000000000860000-0x0000000000D5B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2104-45-0x0000000000860000-0x0000000000D5B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2136-525-0x000000013FC80000-0x0000000140110000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/2156-271-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2156-274-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2156-272-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2156-263-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2156-265-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2156-269-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2156-267-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2204-567-0x0000000000050000-0x000000000054B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2212-436-0x0000000000AD0000-0x0000000001744000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/2756-112-0x0000000006E30000-0x0000000007AA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/2756-23-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-21-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-22-0x0000000000E21000-0x0000000000E4F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2756-423-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-24-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-463-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-26-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-223-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-42-0x0000000006E30000-0x000000000732B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2756-192-0x0000000006E30000-0x0000000007AA4000-memory.dmp

                        Filesize

                        12.5MB

                        Download

                      • memory/2756-44-0x0000000006E30000-0x000000000732B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2756-146-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-46-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-48-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-122-0x0000000006E30000-0x000000000767D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2756-62-0x0000000006430000-0x000000000673D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2756-350-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-64-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-111-0x0000000006430000-0x000000000673D000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/2756-79-0x0000000006E30000-0x000000000732B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2756-94-0x0000000006E30000-0x000000000767D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2756-95-0x0000000000E20000-0x00000000012E4000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2756-92-0x0000000006E30000-0x000000000732B000-memory.dmp

                        Filesize

                        5.0MB

                        Download

                      • memory/2856-19-0x00000000069A0000-0x0000000006E64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2856-16-0x00000000069A0000-0x0000000006E64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2856-0-0x0000000000AA0000-0x0000000000F64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2856-1-0x00000000771B0000-0x00000000771B2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2856-2-0x0000000000AA1000-0x0000000000ACF000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2856-3-0x0000000000AA0000-0x0000000000F64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2856-5-0x0000000000AA0000-0x0000000000F64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2856-18-0x0000000000AA0000-0x0000000000F64000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2880-443-0x0000000000B90000-0x000000000181E000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/2880-532-0x0000000000B90000-0x000000000181E000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/2880-590-0x0000000000B90000-0x000000000181E000-memory.dmp

                        Filesize

                        12.6MB

                        Download

                      • memory/2948-147-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-351-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-359-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-96-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-224-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-143-0x0000000000400000-0x0000000000C4D000-memory.dmp

                        Filesize

                        8.3MB

                        Download

                      • memory/2948-118-0x0000000010000000-0x000000001001C000-memory.dmp

                        Filesize

                        112KB

                        Download

                      • memory/2952-409-0x0000000000DA0000-0x0000000000EF7000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/2972-422-0x0000000000C80000-0x0000000000C8C000-memory.dmp

                        Filesize

                        48KB

                        Download

                      • memory/3588-936-0x0000000001F10000-0x0000000001F18000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/3588-933-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                        Filesize

                        2.9MB

                        Download