Overview

overview

10

Static

static

3

dae2d57bde...1N.exe

windows7-x64

10

dae2d57bde...1N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 08:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dae2d57bde6ac1129c63d0dbb41ce10b7f9049bbd751edf0a23849d4c84a0801N.exe

  • Size

    2.8MB

  • MD5

    b431e6af4d8fc2087e9bd95d66998fb0

  • SHA1

    11302074753c0b0f424261bcf9dee6b4392eaaee

  • SHA256

    dae2d57bde6ac1129c63d0dbb41ce10b7f9049bbd751edf0a23849d4c84a0801

  • SHA512

    9f9f6998a6fd990ae40ff2d2d0f532eea0512fc3d9173f7783d028de967d0da2d0ffc89483cec1ae11c2be36a4722d0ebac7cff2fdcbcd148dfa4d2f49d0a393

  • SSDEEP

    49152:qp7gdvGyTA3H5OkC15FpHxnQQK+1nIFHFaJEix1v8K:qudvGcSH5Ok65FpRnPIF2Eix1k

Score
10/10
amadeycryptbotgcleanerlummastealcxmrig9c9aa5stokdiscoveryevasionloaderminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • XMRig Miner payload 13 IoCs
    miner
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\dae2d57bde6ac1129c63d0dbb41ce10b7f9049bbd751edf0a23849d4c84a0801N.exe
    "C:\Users\Admin\AppData\Local\Temp\dae2d57bde6ac1129c63d0dbb41ce10b7f9049bbd751edf0a23849d4c84a0801N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Users\Admin\AppData\Local\Temp\1020015001\d5673bf5b3.exe
        "C:\Users\Admin\AppData\Local\Temp\1020015001\d5673bf5b3.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3092
        • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
          "C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:408
      • C:\Users\Admin\AppData\Local\Temp\1020016001\52c8243a03.exe
        "C:\Users\Admin\AppData\Local\Temp\1020016001\52c8243a03.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Program Files\Windows Media Player\graph\graph.exe
          "C:\Program Files\Windows Media Player\graph\graph.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1124
      • C:\Users\Admin\AppData\Local\Temp\1020017001\d46d624060.exe
        "C:\Users\Admin\AppData\Local\Temp\1020017001\d46d624060.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:2932
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:184
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_7.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2552
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2092
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3968
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2364
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4604
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4316
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:956
            • C:\Windows\system32\attrib.exe
              attrib +H "in.exe"
              5⤵
              • Views/modifies file attributes
              PID:3640
            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
              "in.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2960
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:4728
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:4800
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4668
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.0.0.1; del in.exe
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4576
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:3208
        • C:\Users\Admin\AppData\Local\Temp\1020018001\89887924d4.exe
          "C:\Users\Admin\AppData\Local\Temp\1020018001\89887924d4.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:640
        • C:\Users\Admin\AppData\Local\Temp\1020019001\14af6606fa.exe
          "C:\Users\Admin\AppData\Local\Temp\1020019001\14af6606fa.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3216
        • C:\Users\Admin\AppData\Local\Temp\1020020001\e43e9a7b65.exe
          "C:\Users\Admin\AppData\Local\Temp\1020020001\e43e9a7b65.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4336
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 644
            4⤵
            • Program crash
            PID:5760
        • C:\Users\Admin\AppData\Local\Temp\1020021001\539d90b255.exe
          "C:\Users\Admin\AppData\Local\Temp\1020021001\539d90b255.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2784
        • C:\Users\Admin\AppData\Local\Temp\1020022001\2267aad155.exe
          "C:\Users\Admin\AppData\Local\Temp\1020022001\2267aad155.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2092
          • C:\Users\Admin\AppData\Local\Temp\1020022001\2267aad155.exe
            "C:\Users\Admin\AppData\Local\Temp\1020022001\2267aad155.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3920
        • C:\Users\Admin\AppData\Local\Temp\1020023001\03e575e5c6.exe
          "C:\Users\Admin\AppData\Local\Temp\1020023001\03e575e5c6.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          PID:3876
        • C:\Users\Admin\AppData\Local\Temp\1020024001\02240311a4.exe
          "C:\Users\Admin\AppData\Local\Temp\1020024001\02240311a4.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          PID:4232
        • C:\Users\Admin\AppData\Local\Temp\1020025001\637921a84e.exe
          "C:\Users\Admin\AppData\Local\Temp\1020025001\637921a84e.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4544
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4964
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3608
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2032
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2904
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:516
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:1344
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:1988
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b6726b1-5779-45f4-9188-3e19fa013955} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" gpu
                  6⤵
                    PID:1964
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59ea7246-432c-4ca8-b1dc-81f02097e4df} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" socket
                    6⤵
                      PID:4824
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38bbb4f6-b19a-4035-bd6e-608af18ae874} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" tab
                      6⤵
                        PID:3852
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 1244 -prefMapHandle 896 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f3402c7-4e14-4c56-9d32-eac7f71760a5} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" tab
                        6⤵
                          PID:1832
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4864 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4812 -prefMapHandle 4860 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceca60ba-23ff-44c5-8d78-c36115c684a4} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5540
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -childID 3 -isForBrowser -prefsHandle 5224 -prefMapHandle 5212 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8adfbea-f535-4f6f-9ca2-97f4d07550fa} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" tab
                          6⤵
                            PID:6084
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 4 -isForBrowser -prefsHandle 5380 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68209da3-e355-4120-b6f7-458ae11e4957} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" tab
                            6⤵
                              PID:6116
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5604 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {648e420a-e3e4-45e0-aec7-e539799a321a} 1988 "\\.\pipe\gecko-crash-server-pipe.1988" tab
                              6⤵
                                PID:6128
                        • C:\Users\Admin\AppData\Local\Temp\1020026001\8e21bc376f.exe
                          "C:\Users\Admin\AppData\Local\Temp\1020026001\8e21bc376f.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5736
                        • C:\Users\Admin\AppData\Local\Temp\1020027001\570fe258c9.exe
                          "C:\Users\Admin\AppData\Local\Temp\1020027001\570fe258c9.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:6016
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 1476
                            4⤵
                            • Program crash
                            PID:2096
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:3024
                    • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                      C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2380
                    • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:4296
                      • C:\Windows\explorer.exe
                        explorer.exe
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2024
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                        2⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4944
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.1.10.1
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:336
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4336 -ip 4336
                      1⤵
                        PID:5676
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6016 -ip 6016
                        1⤵
                          PID:1344
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:3200
                        • C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                          C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe
                          1⤵
                          • Executes dropped EXE
                          PID:4016
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4264
                          • C:\Windows\explorer.exe
                            explorer.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3608
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            2⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3588
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              3⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:5944

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Query Registry

                        8
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files\Windows Media Player\graph\graph.exe
                          Filesize

                          245KB

                          MD5

                          7d254439af7b1caaa765420bea7fbd3f

                          SHA1

                          7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

                          SHA256

                          d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

                          SHA512

                          c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          Filesize

                          2KB

                          MD5

                          6cf293cb4d80be23433eecf74ddb5503

                          SHA1

                          24fe4752df102c2ef492954d6b046cb5512ad408

                          SHA256

                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                          SHA512

                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OVS68NE\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          1KB

                          MD5

                          d3235ed022a42ec4338123ab87144afa

                          SHA1

                          5058608bc0deb720a585a2304a8f7cf63a50a315

                          SHA256

                          10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

                          SHA512

                          236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          24KB

                          MD5

                          c54546a4bf281811ba71b5f18626bb9e

                          SHA1

                          799816e11afd2d092157df58e12c02c91bfecde7

                          SHA256

                          b7341659a0bfa8a2956ec45c986389465e5ac292cd3169d4c9976eac66267993

                          SHA512

                          045f019a4130e1c850229a477590482715ec630e568623dc6a8edfdd6711c1e6c9036efbe11f252fe34aa220bcf675234591e7f01e1a425ac88808dfda2a9c4b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31
                          Filesize

                          13KB

                          MD5

                          ada64b5f167f86ba13799c13355ca460

                          SHA1

                          46105434bdcd513d196f86e1cc012f96df0d6937

                          SHA256

                          7c0b101647decab11dd6f266cd3cbf4a55fa91447f6ee2754228c21d0944f775

                          SHA512

                          0ee357ae19e3fba71038cc034db2d907f80288d48ae462d970082d9ea5b43629afd7bd0bd5d196e7cc58f7a1474873c9d67c8891b0594cc9297062fc34a15938

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                          Filesize

                          13KB

                          MD5

                          a70ad3a80f34f2219e352eabcacb57cd

                          SHA1

                          b4668b14dd774da14b93c21ce2f4f45023caaeaf

                          SHA256

                          d621a0cc6b2e6ca9381a6e340962a71286386ff23d5f384023b260e594a951bf

                          SHA512

                          dd2b03a6ad0741a57bf1c377f27ff657dd5a8affba710b6b66d4341b8bf1044c9a8aa19ad2d1ba9cb8b2bb0158855830fdd41498e6fe91472083ff55634d0b60

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020015001\d5673bf5b3.exe
                          Filesize

                          429KB

                          MD5

                          51ff79b406cb223dd49dd4c947ec97b0

                          SHA1

                          b9b0253480a1b6cbdd673383320fecae5efb3dce

                          SHA256

                          2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e

                          SHA512

                          c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020016001\52c8243a03.exe
                          Filesize

                          591KB

                          MD5

                          3567cb15156760b2f111512ffdbc1451

                          SHA1

                          2fdb1f235fc5a9a32477dab4220ece5fda1539d4

                          SHA256

                          0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

                          SHA512

                          e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020017001\d46d624060.exe
                          Filesize

                          4.2MB

                          MD5

                          3a425626cbd40345f5b8dddd6b2b9efa

                          SHA1

                          7b50e108e293e54c15dce816552356f424eea97a

                          SHA256

                          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                          SHA512

                          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020018001\89887924d4.exe
                          Filesize

                          4.3MB

                          MD5

                          faf718856c97bf090fa14d751014aa12

                          SHA1

                          d536f3b51af70c809baa2759873791caeb8d6f38

                          SHA256

                          d56ba5e51f2ea3ce492e545bac05b0b5ca2c25ec6608ee2c2738d4f815b3eab2

                          SHA512

                          6c9b9d56df87eebd9824d499f8215d47ed8ddbded3d0fe9be7c3d87b2fcc9ca2f3f39f43ec7adfeff09540c51894fe2b3f1e7d7032d77bb5be50ae233855d161

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020019001\14af6606fa.exe
                          Filesize

                          4.3MB

                          MD5

                          4b0cb8cea5700882ecce813c6bb87837

                          SHA1

                          d5a6dc5c04a2269897b0dea5041352b7198324ed

                          SHA256

                          fc85d7c03c2859a7a9f7c6450931aa0c856f0e3b24918ba3794694cc29ce1966

                          SHA512

                          dd50a5b28aa4091213ef065a78211c7d586909d141d468341af12eeae0d547963cfe1f72056edcb6ca2006be5b87a2fef236242d6057cf02b009541060da1380

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020020001\e43e9a7b65.exe
                          Filesize

                          1.9MB

                          MD5

                          63737b2ece68d77276edc5d3b31e5fe3

                          SHA1

                          ff8a0b492f95baae647c322c6c44f6a479c89433

                          SHA256

                          87a8db1b4e00856261a01ddcc80a09fcb9f70c7c4fc665ef3b6701f63ca44f27

                          SHA512

                          e2fdf7e5cbdb2fb30d195024b1197e0f885a15d8ed52058695d82de4865c682ce3ad64ed9549f78cf87a3019fccf3f2c27e3f992b34305baa50bfa9ba8114cd6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020021001\539d90b255.exe
                          Filesize

                          2.5MB

                          MD5

                          87330f1877c33a5a6203c49075223b16

                          SHA1

                          55b64ee8b2d1302581ab1978e9588191e4e62f81

                          SHA256

                          98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

                          SHA512

                          7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020022001\2267aad155.exe
                          Filesize

                          758KB

                          MD5

                          afd936e441bf5cbdb858e96833cc6ed3

                          SHA1

                          3491edd8c7caf9ae169e21fb58bccd29d95aefef

                          SHA256

                          c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                          SHA512

                          928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020023001\03e575e5c6.exe
                          Filesize

                          1.7MB

                          MD5

                          7884feeb676b85c98dbbe6a0e6f92cbc

                          SHA1

                          897b3e60a77b96d2423525a6db8ccb386abeb14d

                          SHA256

                          80e820374e64aba34f70f88c5d7d3ecf7967d833d1ab674d50379ee4034a30d0

                          SHA512

                          99697017c1e6402cbd21795fa7c4ee1b3302558ae26d7e1e780d47257d4535a32a11da8d80504956d575407e0c5038808acec2aaa8ec9038084c0df32cdbaee2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020024001\02240311a4.exe
                          Filesize

                          2.8MB

                          MD5

                          6ad8c80adf22544fa38534491968ee1f

                          SHA1

                          10630c3020fcafd52ea2d67385fdee4278a65121

                          SHA256

                          7bd38004d31037e2310abca4378bdc296a0a35bd3a5b4cc892d44bdbf5a89779

                          SHA512

                          ad73321f2698d344832e991310d3c3e6f8ea494094c81f949b229f6e76b0a259dc364d958afd2562f5d2b0166cc0795ce297af20e072e46899a66a1332787a65

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020025001\637921a84e.exe
                          Filesize

                          945KB

                          MD5

                          f0edc4a9bd9171ace28fbde9de67ac29

                          SHA1

                          2c6cb21e995a87b020f80c85d28d5277462fb98a

                          SHA256

                          6b2c619e6231a7641d5e61786105ca5400252d107125ca6b6c4dad9826f95ef1

                          SHA512

                          958b90c795346728d6d296a24b357b876383e45012c429eb620bc2860fc26095d317c9605ac26872dd9af81f7917b5884f6500b0f67e6a94a9efca958bab724a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020026001\8e21bc376f.exe
                          Filesize

                          2.7MB

                          MD5

                          e3d6f4bdc765aa7350990ec8657777ea

                          SHA1

                          e2c315138f5ecc958ac1bbe5acc3d8ac87260425

                          SHA256

                          e74744eda82aa148824f0963e14cf99f162e2aff444436b514db04f8ee79da2e

                          SHA512

                          294f70cdaf3ed0ffe9b75c0e9442530cd64bd2497395e164c8cc20728f90c8e942062ed852512de85f6be445145a7e823865f776af75adf2156f50b8a7d80327

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020027001\570fe258c9.exe
                          Filesize

                          1.8MB

                          MD5

                          15709eba2afaf7cc0a86ce0abf8e53f1

                          SHA1

                          238ebf0d386ecf0e56d0ddb60faca0ea61939bb6

                          SHA256

                          10bff40a9d960d0be3cc81b074a748764d7871208f324de26d365b1f8ea3935a

                          SHA512

                          65edefa20f0bb35bee837951ccd427b94a18528c6e84de222b1aa0af380135491bb29a049009f77e66fcd2abe5376a831d98e39055e1042ccee889321b96e8e9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lrkuhcjb.iev.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          Filesize

                          2.8MB

                          MD5

                          b431e6af4d8fc2087e9bd95d66998fb0

                          SHA1

                          11302074753c0b0f424261bcf9dee6b4392eaaee

                          SHA256

                          dae2d57bde6ac1129c63d0dbb41ce10b7f9049bbd751edf0a23849d4c84a0801

                          SHA512

                          9f9f6998a6fd990ae40ff2d2d0f532eea0512fc3d9173f7783d028de967d0da2d0ffc89483cec1ae11c2be36a4722d0ebac7cff2fdcbcd148dfa4d2f49d0a393

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                          Filesize

                          1.6MB

                          MD5

                          72491c7b87a7c2dd350b727444f13bb4

                          SHA1

                          1e9338d56db7ded386878eab7bb44b8934ab1bc7

                          SHA256

                          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                          SHA512

                          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          Filesize

                          458KB

                          MD5

                          619f7135621b50fd1900ff24aade1524

                          SHA1

                          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                          SHA256

                          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                          SHA512

                          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
                          Filesize

                          2.2MB

                          MD5

                          579a63bebccbacab8f14132f9fc31b89

                          SHA1

                          fca8a51077d352741a9c1ff8a493064ef5052f27

                          SHA256

                          0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

                          SHA512

                          4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
                          Filesize

                          1.7MB

                          MD5

                          5659eba6a774f9d5322f249ad989114a

                          SHA1

                          4bfb12aa98a1dc2206baa0ac611877b815810e4c

                          SHA256

                          e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

                          SHA512

                          f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                          Filesize

                          1.7MB

                          MD5

                          5404286ec7853897b3ba00adf824d6c1

                          SHA1

                          39e543e08b34311b82f6e909e1e67e2f4afec551

                          SHA256

                          ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

                          SHA512

                          c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                          Filesize

                          1.7MB

                          MD5

                          5eb39ba3698c99891a6b6eb036cfb653

                          SHA1

                          d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                          SHA256

                          e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                          SHA512

                          6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                          Filesize

                          1.7MB

                          MD5

                          7187cc2643affab4ca29d92251c96dee

                          SHA1

                          ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                          SHA256

                          c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                          SHA512

                          27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                          Filesize

                          1.7MB

                          MD5

                          b7d1e04629bec112923446fda5391731

                          SHA1

                          814055286f963ddaa5bf3019821cb8a565b56cb8

                          SHA256

                          4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                          SHA512

                          79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                          Filesize

                          1.7MB

                          MD5

                          0dc4014facf82aa027904c1be1d403c1

                          SHA1

                          5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                          SHA256

                          a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                          SHA512

                          cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                          Filesize

                          3.3MB

                          MD5

                          cea368fc334a9aec1ecff4b15612e5b0

                          SHA1

                          493d23f72731bb570d904014ffdacbba2334ce26

                          SHA256

                          07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                          SHA512

                          bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\in.exe
                          Filesize

                          1.7MB

                          MD5

                          83d75087c9bf6e4f07c36e550731ccde

                          SHA1

                          d5ff596961cce5f03f842cfd8f27dde6f124e3ae

                          SHA256

                          46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

                          SHA512

                          044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                          Filesize

                          3.3MB

                          MD5

                          045b0a3d5be6f10ddf19ae6d92dfdd70

                          SHA1

                          0387715b6681d7097d372cd0005b664f76c933c7

                          SHA256

                          94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                          SHA512

                          58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                          Filesize

                          440B

                          MD5

                          3626532127e3066df98e34c3d56a1869

                          SHA1

                          5fa7102f02615afde4efd4ed091744e842c63f78

                          SHA256

                          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                          SHA512

                          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                          Filesize

                          6KB

                          MD5

                          5c422c66bbd9fea8a869b214a643e5b7

                          SHA1

                          36526a919ec583af2a6996f2f0385add489d8009

                          SHA256

                          37c008d2995c23c7f157c55b79b6caf9b5b78de7234a0560e72734b4bcd1b905

                          SHA512

                          2008af5f280bd6faabef48750688bb75a5d8602ae2061bd8c0d2fdbf284bf1427c43245a6e65d622a01137f63380db6e21c85ac022818ea3cca3c0cebdba90ba

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                          Filesize

                          7KB

                          MD5

                          edcd40ef5f1e7d0d7c6bcd03088e4ad4

                          SHA1

                          29e2761434e7d2f2387db27bf3acacde043b1b8d

                          SHA256

                          c427771073072eceb4d6a23d68b33b69d33a62eeb4138e7662c1aa5d1974ad73

                          SHA512

                          39177ccf321902b485da03219d08bc6daa975575452b889da1c2df0f9391a493205d296e614638a214c39ca99121ceb412cb51a356dda9c0844e658f62896a81

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          d9761d8d72a6c2cac20db0c629262a22

                          SHA1

                          9386aa968fc7513805eb4f3e8e555d059aba35ce

                          SHA256

                          eabbf2911b232e5f6fb9a067da5470df011e4c59c14e9496bf11534df23da12d

                          SHA512

                          8286a3bd41e3247d2c5d0dca2fc7a29d73f6451346b696fe3240cb5091abbd4211d7c18ec56b0d3e3d91b84be561d00c58f710444ab12a9b10e29fa23fd799e2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          15KB

                          MD5

                          0ed37a7fa81ea263933c7519c59caa48

                          SHA1

                          55051fc5dd00afe08ba72217c748ea4af82324bf

                          SHA256

                          c38f0eb9855a47834e4efb23f6689244fa7b2a8bc582fed0bc353c483fbdb5ea

                          SHA512

                          e85edb6d2e1990e4c75ab2424f445cca40cc600a1dedb25d971d6bc731a7a5ed28dc7324874ac388ffd79044c044f0845606d72385fb81e4fe84e533ab274fb0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                          Filesize

                          5KB

                          MD5

                          70fee55a1ce5ccdaa7815095cd786b9e

                          SHA1

                          8a2c29c488ad8e6cdbe7ebe1575560643a8ccd6f

                          SHA256

                          4b86a425f9ad4062cfef2dfc0682c02820d78b82da526360d6bc66a19b856e4a

                          SHA512

                          71f4df964ff3d691dc679aee744a104f75bec0e791fea02166089ce34e9621442bb4347933e984dbc11d9221bb98d899f2324c927dda32d153e06ec2881cb207

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\85e2476b-b2a8-4f83-8c75-aff853c8e4c0
                          Filesize

                          982B

                          MD5

                          bfa053d28c1e43a220f1f8bfe9e9a99b

                          SHA1

                          89c9a0071feb2177ec2769778c879fd84bfa1b61

                          SHA256

                          847eebc6f044212ac3128123138f34292151f161323e67ead8d65e0e87ace653

                          SHA512

                          89c652db37fa195cb96842d9a7c4c3be209b2b20921daa5b6b46e2e45181264fd24669ab0f3930498037b4cec0abb96ca1d38dbe00401eb39164c2255e6f17e2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\b0ae5b2a-5c72-4133-8b6e-09f90791b574
                          Filesize

                          671B

                          MD5

                          749cab993bc8a1b3e90ff63bb896d5a5

                          SHA1

                          3b96f1058618063e44258b2052295eb149da4021

                          SHA256

                          9577ba88c1d4f9faf0e8f5d6ad530c577ab0472057121b379e0525dad9192323

                          SHA512

                          0d115409e9f13e1b8153bacf30ebf043d81bf71d07e8c63d0bb412fce8a5ff8717cae2638b43bdf0340bea6beb87ce93147b241fae964e275ff888a44be10187

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\cbc085d4-3118-47e9-ac82-26e8b3737f15
                          Filesize

                          25KB

                          MD5

                          0d789c8b2790c02948827312d7dbfd01

                          SHA1

                          45acc86811efa8f47cf252edec6ac42a4ec47271

                          SHA256

                          e128a34abbd8cbecc87cd8d8e94d69487e2a1a1debdab66bbd5e3f390ceba174

                          SHA512

                          60c1286da92de5ce8d024d22d666b77e2011b4284da2af6962046735163ed58926c617f009e51949782370372259f48d9651cfa372d3edf82b6832f786a46611

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          15KB

                          MD5

                          88baea791608151b24f60c132d6bc242

                          SHA1

                          36bd9499cdd850e80b46d4490e1b03a77b606515

                          SHA256

                          ebd17c7ebd8dd1715021158398ba400cf8f55912e298c7b58ee4375b97429e64

                          SHA512

                          87e7453041658d84eb8ab13e8521acc923d03aaed7cff06dc50432c2cb2e69a0aa01d4b4c7dda2f8c482a76b010147ad57f0274c3127ecc1fccd400fe326f7ce

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          10KB

                          MD5

                          d1197ee3382699cd0cf4e41d23d96a40

                          SHA1

                          b3a50e9e8c1e9f3629855845402ee6616176da6f

                          SHA256

                          899642fab3ad6e22acc125b7aeda8c93699fb959e7315fdf9b93b254380a9a73

                          SHA512

                          a3e877fa4f34b2a67ff94d8f2c07628c05301fe57e056902fd69c900f16784b47b7ff6de920f4ce010894ebfe1bcddd4bc61356ff5a26fc2ced12c780a319da4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                          Filesize

                          12KB

                          MD5

                          ea03e5e12c3856d41aabaf23e1cda3dc

                          SHA1

                          b53acd1ab2221b35586384a8aa703dd6ebe1fdb2

                          SHA256

                          63cd80f582d84c802e85897a5af357036e6c0c9fc53bd69aee8c7d878efe4910

                          SHA512

                          277fc38afd761118bbfe28d7e1cad127a8da4a52fa3784c5018c76135826abe4361349067d1e37386df60a692e2453db2892a940fe393c745fdc06d631fdfde5

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                          Filesize

                          10KB

                          MD5

                          1776415c575d1f90eb589416c44b90c8

                          SHA1

                          323a7811cb4719f97694632cbd2dcdd44216e7c7

                          SHA256

                          edba326a860d083076b286598dcd9ef9180b3b6f6fe2ba625b20bdd58213e26c

                          SHA512

                          afa6176d6e69c7f6c445d8101641731b79eec94d228c1834582daaeb60c1b2555b63cbfa9e3958b214f5c03c9e662ae2be884f47e46847dbf511f162d0c9bb15

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                          Filesize

                          2.4MB

                          MD5

                          892df0249d6b6d720184c44a485363da

                          SHA1

                          761611d29b958ab03125a8d789ce3b74e9c0a93a

                          SHA256

                          b104dbd7d61a270d9d54be941bfbdbc78f4931116576232cee457813cf41c9b6

                          SHA512

                          864ec8e85c44710f41c04ade0fde6278e596001bb79467b0ce79e70a444504b2e59e12feb2bde583070a904ddda5594fa8c77207b75da3e8d2a1e43fe3d7ed95

                          Download Submit

                        • memory/324-3936-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-16-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-69-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-49-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-22-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-4074-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-50-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-211-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-21-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-20-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-423-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-1814-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-830-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-846-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-19-0x0000000000591000-0x00000000005BF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/324-334-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-262-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/324-373-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/640-227-0x0000000000910000-0x000000000157B000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/640-265-0x0000000000910000-0x000000000157B000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/640-263-0x0000000000910000-0x000000000157B000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/640-342-0x0000000000910000-0x000000000157B000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/640-335-0x0000000000910000-0x000000000157B000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/896-2-0x00000000004C1000-0x00000000004EF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/896-18-0x00000000004C0000-0x00000000007CC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/896-3-0x00000000004C0000-0x00000000007CC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/896-1-0x00000000776A4000-0x00000000776A6000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/896-0-0x00000000004C0000-0x00000000007CC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/896-4-0x00000000004C0000-0x00000000007CC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2024-311-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-303-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-306-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-304-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-305-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-313-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-312-0x0000000002580000-0x00000000025A0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2024-302-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-309-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-308-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-345-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2024-307-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/2960-199-0x00007FF765E50000-0x00007FF7662E0000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2960-196-0x00007FF765E50000-0x00007FF7662E0000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3024-295-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/3024-297-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/3200-3435-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/3200-3469-0x0000000000590000-0x000000000089C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/3216-246-0x0000000000E00000-0x0000000001A76000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/3216-245-0x0000000000E00000-0x0000000001A76000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/3608-3682-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3608-3672-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3608-3724-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3876-371-0x0000000000490000-0x0000000000917000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/3876-367-0x0000000000490000-0x0000000000917000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/3920-350-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/3920-348-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/4232-393-0x00000000005E0000-0x0000000000AE0000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/4232-390-0x00000000005E0000-0x0000000000AE0000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/4264-3733-0x00007FF7A3DB0000-0x00007FF7A4240000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/4296-314-0x00007FF7A3DB0000-0x00007FF7A4240000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/4296-301-0x00007FF7A3DB0000-0x00007FF7A4240000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/4336-336-0x0000000000400000-0x0000000000C62000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/4336-802-0x0000000000400000-0x0000000000C62000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/4336-270-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/4336-264-0x0000000000400000-0x0000000000C62000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/4336-374-0x0000000000400000-0x0000000000C62000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/4336-647-0x0000000000400000-0x0000000000C62000-memory.dmp

                          Filesize

                          8.4MB

                          Download

                        • memory/4576-206-0x000001CB1A880000-0x000001CB1A8A2000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/5736-832-0x0000000000190000-0x000000000043E000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/5736-648-0x0000000000190000-0x000000000043E000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/5736-725-0x0000000000190000-0x000000000043E000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/5736-841-0x0000000000190000-0x000000000043E000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/5736-726-0x0000000000190000-0x000000000043E000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/6016-829-0x00000000002D0000-0x0000000000768000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/6016-816-0x00000000002D0000-0x0000000000768000-memory.dmp

                          Filesize

                          4.6MB

                          Download