Overview

overview

10

Static

static

3

random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2025, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    random.exe
  • Size 5.6MB
  • Sample250331-plnpdasly4
  • SHA256 17903569a4e66d3cc800b10b99d0ffaa424d17bb7c3dec2de3dde02889791d2f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyhealerlummaquasarstealc092155office04trumpdefense_evasiondiscoverydropperevasionexecutionexploitpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://rodformi.run/aUosoz

  • https://metalsyo.digital/opsa

  • https://ironloxp.live/aksdd

  • https://navstarx.shop/FoaJSi

  • https://starcloc.bet/GOksAo

  • https://advennture.top/GKsiio

  • https://targett.top/dsANGt

  • https://cspacedbv.world/EKdlsk

  • https://8galxnetb.today/GsuIAo

  • https://qadvennture.top/GKsiio

  • https://spacedbv.world/EKdlsk

  • https://galxnetb.today/GsuIAo

  • https://wnavstarx.shop/FoaJSi

  • https://3galxnetb.today/GsuIAo

  • https://cosmosyf.top/GOsznj

  • https://esccapewz.run/ANSbwqy

  • https://travewlio.shop/ZNxbHi

  • https://touvrlane.bet/ASKwjq

  • https://sighbtseeing.shop/ASJnzh

  • https://holidamyup.today/AOzkns

Extracted

Family

  • quasar

Version

  • 1.5.0

Botnet

  • Office04

C2

  • 51.89.204.80:4782

Mutex

  • 65581c6d-14ba-4da9-86dd-ffd8304b8eb1

Attributes
  • encryption_key

    8C25D2F2D6CDE756BAFC0531B3B70446BFBAF003

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Extracted

Family

  • stealc

Botnet

  • trump

C2

  • http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to execute payload.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 18 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 45 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2K27.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2K27.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h60C7.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h60C7.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4384
          • C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
            "C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2616
          • C:\Users\Admin\AppData\Local\Temp\10385170101\nAM5wkr.exe
            "C:\Users\Admin\AppData\Local\Temp\10385170101\nAM5wkr.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3032
            • C:\Windows\SYSTEM32\CMD.exe
              "CMD" netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" WindowsControl ENABLE & exit
              6⤵
                PID:540
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft Cloud" /tr "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" /RL HIGHEST & exit
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1708
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc minute /mo 1 /tn "Microsoft Cloud" /tr "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe" /RL HIGHEST
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:5004
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft DotNet Kernel" /tr "C:\Users\Admin\AppData\Roaming\xdwdmicrosoft.exe" /RL HIGHEST & exit
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1096
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc minute /mo 30 /tn "Microsoft DotNet Kernel" /tr "C:\Users\Admin\AppData\Roaming\xdwdmicrosoft.exe" /RL HIGHEST
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:4868
              • C:\Users\Admin\AppData\Roaming\xdwdkernel.exe
                "C:\Users\Admin\AppData\Roaming\xdwdkernel.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:3904
            • C:\Users\Admin\AppData\Local\Temp\10386410101\bprz1VA.exe
              "C:\Users\Admin\AppData\Local\Temp\10386410101\bprz1VA.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2352
              • C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe
                "C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:776
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2440
              • C:\Users\Admin\AppData\Local\Temp\Built.exe
                "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4592
                • C:\Users\Admin\AppData\Local\Temp\Built.exe
                  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3052
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
                    8⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3252
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2736
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                    8⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:544
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2160
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                    8⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:624
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      9⤵
                      • Loads dropped DLL
                      • Enumerates processes with tasklist
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5012
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                    8⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4160
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic csproduct get uuid
                      9⤵
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5112
              • C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe
                "C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4632
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:436
            • C:\Users\Admin\AppData\Local\Temp\10391640101\gLLOqKC.exe
              "C:\Users\Admin\AppData\Local\Temp\10391640101\gLLOqKC.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4932
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2352
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe"
                  7⤵
                    PID:6140
                    • C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe
                      "C:\Users\Admin\AppData\Local\Temp\f9827b8d90\tgvazx.exe"
                      8⤵
                        PID:5872
                • C:\Users\Admin\AppData\Local\Temp\10392050101\apple.exe
                  "C:\Users\Admin\AppData\Local\Temp\10392050101\apple.exe"
                  5⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4200
                  • C:\Users\Admin\AppData\Local\Temp\221.exe
                    "C:\Users\Admin\AppData\Local\Temp\221.exe"
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1484
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6174.tmp\6175.tmp\6176.bat C:\Users\Admin\AppData\Local\Temp\221.exe"
                      7⤵
                      • Loads dropped DLL
                      PID:4348
                      • C:\Users\Admin\AppData\Local\Temp\221.exe
                        "C:\Users\Admin\AppData\Local\Temp\221.exe" go
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1472
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\62DC.tmp\62DD.tmp\62DE.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"
                          9⤵
                          • Loads dropped DLL
                          PID:4520
                          • C:\Windows\system32\sc.exe
                            sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                            10⤵
                            • Launches sc.exe
                            PID:1396
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            10⤵
                            • Launches sc.exe
                            PID:2744
                          • C:\Windows\system32\timeout.exe
                            timeout /t 1
                            10⤵
                            • Loads dropped DLL
                            • Delays execution with timeout.exe
                            PID:4484
                          • C:\Windows\system32\sc.exe
                            sc stop ddrver
                            10⤵
                            • Launches sc.exe
                            PID:3004
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            10⤵
                            • Launches sc.exe
                            PID:4596
                          • C:\Windows\system32\takeown.exe
                            takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                            10⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:412
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                            10⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:60
                          • C:\Windows\system32\sc.exe
                            sc stop "WinDefend"
                            10⤵
                            • Launches sc.exe
                            PID:4572
                          • C:\Windows\system32\sc.exe
                            sc delete "WinDefend"
                            10⤵
                            • Launches sc.exe
                            PID:1504
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                            10⤵
                              PID:2096
                            • C:\Windows\system32\sc.exe
                              sc stop "MDCoreSvc"
                              10⤵
                              • Launches sc.exe
                              PID:3368
                            • C:\Windows\system32\sc.exe
                              sc delete "MDCoreSvc"
                              10⤵
                              • Launches sc.exe
                              PID:764
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                              10⤵
                                PID:3328
                              • C:\Windows\system32\sc.exe
                                sc stop "WdNisSvc"
                                10⤵
                                • Launches sc.exe
                                PID:1344
                              • C:\Windows\system32\sc.exe
                                sc delete "WdNisSvc"
                                10⤵
                                • Launches sc.exe
                                PID:916
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                10⤵
                                  PID:388
                                • C:\Windows\system32\sc.exe
                                  sc stop "Sense"
                                  10⤵
                                  • Launches sc.exe
                                  PID:4900
                                • C:\Windows\system32\sc.exe
                                  sc delete "Sense"
                                  10⤵
                                  • Launches sc.exe
                                  PID:4568
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                  10⤵
                                    PID:2960
                                  • C:\Windows\system32\sc.exe
                                    sc stop "wscsvc"
                                    10⤵
                                    • Launches sc.exe
                                    PID:1132
                                  • C:\Windows\system32\sc.exe
                                    sc delete "wscsvc"
                                    10⤵
                                    • Launches sc.exe
                                    PID:2984
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                    10⤵
                                    • Modifies security service
                                    PID:2996
                                  • C:\Windows\system32\sc.exe
                                    sc stop "SgrmBroker"
                                    10⤵
                                    • Launches sc.exe
                                    PID:1088
                                  • C:\Windows\system32\sc.exe
                                    sc delete "SgrmBroker"
                                    10⤵
                                    • Launches sc.exe
                                    PID:624
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                    10⤵
                                      PID:1416
                                    • C:\Windows\system32\sc.exe
                                      sc stop "SecurityHealthService"
                                      10⤵
                                      • Launches sc.exe
                                      PID:4288
                                    • C:\Windows\system32\sc.exe
                                      sc delete "SecurityHealthService"
                                      10⤵
                                      • Launches sc.exe
                                      PID:4592
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                      10⤵
                                        PID:1672
                                      • C:\Windows\system32\sc.exe
                                        sc stop "webthreatdefsvc"
                                        10⤵
                                        • Launches sc.exe
                                        PID:2276
                                      • C:\Windows\system32\sc.exe
                                        sc delete "webthreatdefsvc"
                                        10⤵
                                        • Launches sc.exe
                                        PID:3436
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                        10⤵
                                          PID:2492
                                        • C:\Windows\system32\sc.exe
                                          sc stop "webthreatdefusersvc"
                                          10⤵
                                          • Launches sc.exe
                                          PID:2988
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefusersvc"
                                          10⤵
                                          • Launches sc.exe
                                          PID:3196
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                          10⤵
                                            PID:3020
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdNisDrv"
                                            10⤵
                                            • Launches sc.exe
                                            PID:3944
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdNisDrv"
                                            10⤵
                                            • Launches sc.exe
                                            PID:648
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                            10⤵
                                              PID:2544
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdBoot"
                                              10⤵
                                              • Launches sc.exe
                                              PID:4208
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdBoot"
                                              10⤵
                                              • Launches sc.exe
                                              PID:1476
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                              10⤵
                                                PID:4852
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdFilter"
                                                10⤵
                                                • Launches sc.exe
                                                PID:1740
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdFilter"
                                                10⤵
                                                • Launches sc.exe
                                                PID:2428
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                10⤵
                                                  PID:3428
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "SgrmAgent"
                                                  10⤵
                                                  • Launches sc.exe
                                                  PID:4376
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "SgrmAgent"
                                                  10⤵
                                                  • Launches sc.exe
                                                  PID:4540
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                  10⤵
                                                    PID:1780
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecWfp"
                                                    10⤵
                                                    • Launches sc.exe
                                                    PID:2064
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecWfp"
                                                    10⤵
                                                    • Launches sc.exe
                                                    PID:3792
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                    10⤵
                                                      PID:3940
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "MsSecFlt"
                                                      10⤵
                                                      • Launches sc.exe
                                                      PID:2656
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "MsSecFlt"
                                                      10⤵
                                                      • Launches sc.exe
                                                      PID:2636
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                      10⤵
                                                        PID:3624
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecCore"
                                                        10⤵
                                                        • Launches sc.exe
                                                        PID:4396
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecCore"
                                                        10⤵
                                                        • Launches sc.exe
                                                        PID:3456
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                        10⤵
                                                          PID:4676
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                          10⤵
                                                            PID:4716
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                            10⤵
                                                              PID:2752
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                              10⤵
                                                                PID:2396
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                10⤵
                                                                  PID:3844
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop ddrver
                                                                  10⤵
                                                                  • Launches sc.exe
                                                                  PID:4888
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete ddrver
                                                                  10⤵
                                                                  • Launches sc.exe
                                                                  PID:3628
                                                      • C:\Users\Admin\AppData\Local\Temp\10392901101\a6ae6d0ba4.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10392901101\a6ae6d0ba4.exe"
                                                        5⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Looks for VirtualBox Guest Additions in registry
                                                        • Looks for VMWare Tools registry key
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Adds Run key to start application
                                                        • Checks for VirtualBox DLLs, possible anti-VM trick
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2316
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" "C:WindowsSystem32 orfiles.exe" /p c:windowssystem32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                          6⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1184
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                            7⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3508
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                              8⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2392
                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\rootMicrosoftWindowsDefender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                9⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4556
                                                        • C:\Users\Admin\AppData\Local\Temp\iofolko5\qU4CvgBfFwh0mGQVvuLyZgos.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\iofolko5\qU4CvgBfFwh0mGQVvuLyZgos.exe"
                                                          6⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2440
                                                        • C:\Users\Admin\AppData\Local\Temp\iofolko5\F3DaDXun85gr4wGL3nnzG6gt.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\iofolko5\F3DaDXun85gr4wGL3nnzG6gt.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3228
                                                      • C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3956
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          6⤵
                                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4824
                                                      • C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe"
                                                        5⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3936
                                                        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                                                          6⤵
                                                          • Downloads MZ/PE file
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4452
                                                          • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:3928
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                              8⤵
                                                                PID:2092
                                                            • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              PID:4528
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                8⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5040
                                                            • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:932
                                                              • C:\Users\Admin\AppData\Local\Temp\is-T9D7U.tmp\Bell_Setup16.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-T9D7U.tmp\Bell_Setup16.tmp" /SL5="$100246,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                                                                8⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1580
                                                                • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                                                                  9⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2240
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-KPV8I.tmp\Bell_Setup16.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-KPV8I.tmp\Bell_Setup16.tmp" /SL5="$6026A,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                                                                    10⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:2684
                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                      "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
                                                                      11⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1472
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                                                                        12⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3328
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
                                                                        "PowerShell.exe" -NoProfile -NonInteractive -Command -
                                                                        12⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2716
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                                                                        12⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6192
                                                            • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              PID:7068
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                8⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:7100
                                                              • C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:7284
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                                                                  9⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:7308
                                                            • C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:5028
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                8⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:7840
                                                            • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:8028
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                8⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:8048
                                                            • C:\Users\Admin\AppData\Local\Temp\10046300101\2a8bdb876e.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10046300101\2a8bdb876e.exe"
                                                              7⤵
                                                                PID:6132
                                                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10046300101\2a8bdb876e.exe"
                                                                  8⤵
                                                                    PID:436
                                                                • C:\Users\Admin\AppData\Local\Temp\10046310101\3285e4f19f.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10046310101\3285e4f19f.exe"
                                                                  7⤵
                                                                    PID:6340
                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10046310101\3285e4f19f.exe"
                                                                      8⤵
                                                                        PID:6440
                                                                • C:\Users\Admin\AppData\Local\Temp\10393950101\b15896d78b.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10393950101\b15896d78b.exe"
                                                                  5⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:388
                                                                • C:\Users\Admin\AppData\Local\Temp\10393960101\c3d0fed14a.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10393960101\c3d0fed14a.exe"
                                                                  5⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2268
                                                                • C:\Users\Admin\AppData\Local\Temp\10393970101\0ca9dcca04.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10393970101\0ca9dcca04.exe"
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:5028
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /F /IM firefox.exe /T
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:1328
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /F /IM chrome.exe /T
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:860
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /F /IM msedge.exe /T
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:1520
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /F /IM opera.exe /T
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:2752
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /F /IM brave.exe /T
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Kills process with taskkill
                                                                    PID:3844
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                    6⤵
                                                                    • Loads dropped DLL
                                                                    PID:2096
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                      7⤵
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      • Modifies registry class
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3348
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {326213a9-be24-43dc-b4b8-4691ec6ad7f5} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                        8⤵
                                                                        • Loads dropped DLL
                                                                        PID:8
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2508 -prefsLen 27135 -prefMapHandle 2512 -prefMapSize 270279 -ipcHandle 2520 -initialChannelId {d312edfd-7b12-4bfa-affa-0f4336a72499} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                        8⤵
                                                                          PID:4400
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25164 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {b6e663c6-e96c-478d-b031-263cbc2f14d5} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                          8⤵
                                                                          • Checks processor information in registry
                                                                          PID:3952
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27276 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {0636f598-aedf-4a92-b77e-bd06e69e57f2} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                          8⤵
                                                                            PID:2952
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34775 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {61999f21-8e1b-41ff-953d-df0bc20957b4} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                            8⤵
                                                                            • Checks processor information in registry
                                                                            PID:5212
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5152 -prefsLen 34824 -prefMapHandle 5156 -prefMapSize 270279 -ipcHandle 5092 -initialChannelId {6f9850aa-40de-4bdd-a018-5eef69c6a3c6} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                            8⤵
                                                                            • Checks processor information in registry
                                                                            PID:7628
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32952 -prefMapHandle 5364 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {996a585f-7c7a-49d4-9b56-af73447fa357} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                            8⤵
                                                                            • Checks processor information in registry
                                                                            PID:8076
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {0384326e-25bd-4d56-bb7b-a7c1d9b96858} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                            8⤵
                                                                            • Checks processor information in registry
                                                                            PID:8124
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {d62ac117-c0bf-4297-9298-9705d7ffdab3} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                            8⤵
                                                                            • Checks processor information in registry
                                                                            PID:8140
                                                                    • C:\Users\Admin\AppData\Local\Temp\10393980101\6e9bf6489d.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10393980101\6e9bf6489d.exe"
                                                                      5⤵
                                                                      • Modifies Windows Defender DisableAntiSpyware settings
                                                                      • Modifies Windows Defender Real-time Protection settings
                                                                      • Modifies Windows Defender TamperProtection settings
                                                                      • Modifies Windows Defender notification settings
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Windows security modification
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4808
                                                                    • C:\Users\Admin\AppData\Local\Temp\10393990101\216f0737c9.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10393990101\216f0737c9.exe"
                                                                      5⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6604
                                                                    • C:\Users\Admin\AppData\Local\Temp\10394000101\2a26d33eb0.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10394000101\2a26d33eb0.exe"
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:7524
                                                                    • C:\Users\Admin\AppData\Local\Temp\10394010101\e472f1d9f7.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10394010101\e472f1d9f7.exe"
                                                                      5⤵
                                                                        PID:5460
                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10394010101\e472f1d9f7.exe"
                                                                          6⤵
                                                                            PID:6016
                                                                        • C:\Users\Admin\AppData\Local\Temp\10394020101\61cde20c7d.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10394020101\61cde20c7d.exe"
                                                                          5⤵
                                                                            PID:7184
                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10394020101\61cde20c7d.exe"
                                                                              6⤵
                                                                                PID:6496
                                                                            • C:\Users\Admin\AppData\Local\Temp\10394030101\bprz1VA.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10394030101\bprz1VA.exe"
                                                                              5⤵
                                                                                PID:5164
                                                                                • C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe"
                                                                                  6⤵
                                                                                    PID:6324
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                      7⤵
                                                                                        PID:6676
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                        7⤵
                                                                                          PID:2744
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                                                                        6⤵
                                                                                          PID:4884
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                                                                            7⤵
                                                                                              PID:6716
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
                                                                                                8⤵
                                                                                                  PID:2996
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
                                                                                                    9⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:7516
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                  8⤵
                                                                                                    PID:6948
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                      9⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:7100
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                    8⤵
                                                                                                      PID:2544
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /FO LIST
                                                                                                        9⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        PID:7092
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                      8⤵
                                                                                                        PID:5308
                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                          wmic csproduct get uuid
                                                                                                          9⤵
                                                                                                            PID:7396
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe"
                                                                                                      6⤵
                                                                                                        PID:6688
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                          7⤵
                                                                                                            PID:6704
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                            7⤵
                                                                                                              PID:6604
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2p4752.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2p4752.exe
                                                                                                      3⤵
                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                      • Checks BIOS information in registry
                                                                                                      • Executes dropped EXE
                                                                                                      • Identifies Wine through registry keys
                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:3988
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                  1⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5116
                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                                                                                                    2⤵
                                                                                                      PID:2088
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
                                                                                                    1⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1520
                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                      rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
                                                                                                      2⤵
                                                                                                        PID:4200
                                                                                                    • C:\Users\Admin\AppData\Roaming\xdwdkernel.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\xdwdkernel.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3988
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                      1⤵
                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                      • Checks BIOS information in registry
                                                                                                      • Executes dropped EXE
                                                                                                      • Identifies Wine through registry keys
                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:3268
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\iofolko5\F3DaDXun85gr4wGL3nnzG6gt.exe
                                                                                                      1⤵
                                                                                                        PID:1644
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iofolko5\F3DaDXun85gr4wGL3nnzG6gt.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\iofolko5\F3DaDXun85gr4wGL3nnzG6gt.exe
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3540
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                        1⤵
                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                        • Checks BIOS information in registry
                                                                                                        • Executes dropped EXE
                                                                                                        • Identifies Wine through registry keys
                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                        PID:6240
                                                                                                      • C:\Users\Admin\AppData\Roaming\xdwdkernel.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\xdwdkernel.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6284
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6704

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Reconnaissance

                                                                                                            Resource Development

                                                                                                            Initial Access

                                                                                                            Execution

                                                                                                            Command and Scripting Interpreter

                                                                                                            1
                                                                                                            T1059

                                                                                                            PowerShell

                                                                                                            1
                                                                                                            T1059.001

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Scheduled Task

                                                                                                            1
                                                                                                            T1053.005

                                                                                                            System Services

                                                                                                            2
                                                                                                            T1569

                                                                                                            Service Execution

                                                                                                            2
                                                                                                            T1569.002

                                                                                                            Persistence

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            1
                                                                                                            T1547

                                                                                                            Registry Run Keys / Startup Folder

                                                                                                            1
                                                                                                            T1547.001

                                                                                                            Create or Modify System Process

                                                                                                            7
                                                                                                            T1543

                                                                                                            Windows Service

                                                                                                            7
                                                                                                            T1543.003

                                                                                                            Event Triggered Execution

                                                                                                            1
                                                                                                            T1546

                                                                                                            AppInit DLLs

                                                                                                            1
                                                                                                            T1546.010

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Scheduled Task

                                                                                                            1
                                                                                                            T1053.005

                                                                                                            Privilege Escalation

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            1
                                                                                                            T1547

                                                                                                            Registry Run Keys / Startup Folder

                                                                                                            1
                                                                                                            T1547.001

                                                                                                            Create or Modify System Process

                                                                                                            7
                                                                                                            T1543

                                                                                                            Windows Service

                                                                                                            7
                                                                                                            T1543.003

                                                                                                            Event Triggered Execution

                                                                                                            1
                                                                                                            T1546

                                                                                                            AppInit DLLs

                                                                                                            1
                                                                                                            T1546.010

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Scheduled Task

                                                                                                            1
                                                                                                            T1053.005

                                                                                                            Defense Evasion

                                                                                                            File and Directory Permissions Modification

                                                                                                            1
                                                                                                            T1222

                                                                                                            Impair Defenses

                                                                                                            6
                                                                                                            T1562

                                                                                                            Disable or Modify Tools

                                                                                                            5
                                                                                                            T1562.001

                                                                                                            Modify Registry

                                                                                                            7
                                                                                                            T1112

                                                                                                            Virtualization/Sandbox Evasion

                                                                                                            4
                                                                                                            T1497

                                                                                                            Credential Access

                                                                                                            Unsecured Credentials

                                                                                                            1
                                                                                                            T1552

                                                                                                            Credentials In Files

                                                                                                            1
                                                                                                            T1552.001

                                                                                                            Discovery

                                                                                                            Process Discovery

                                                                                                            1
                                                                                                            T1057

                                                                                                            Query Registry

                                                                                                            9
                                                                                                            T1012

                                                                                                            System Information Discovery

                                                                                                            5
                                                                                                            T1082

                                                                                                            System Location Discovery

                                                                                                            1
                                                                                                            T1614

                                                                                                            System Language Discovery

                                                                                                            1
                                                                                                            T1614.001

                                                                                                            Virtualization/Sandbox Evasion

                                                                                                            4
                                                                                                            T1497

                                                                                                            Lateral Movement

                                                                                                            Collection

                                                                                                            Data from Local System

                                                                                                            1
                                                                                                            T1005

                                                                                                            Command and Control

                                                                                                            Exfiltration

                                                                                                            Impact

                                                                                                            Service Stop

                                                                                                            1
                                                                                                            T1489

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            Admin:.repos
                                                                                                            • Path C:\Users\Admin:.repos
                                                                                                            • Size 1.2MB
                                                                                                            • SHA256 936307143da98e8df462430d2d583bab980235eccb8f90124285650518b68585
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            success[1].htm
                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PEBLFG73\success[1].htm
                                                                                                            • Size 1B
                                                                                                            • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            activity-stream.discovery_stream.json.tmp
                                                                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tdlob5bw.default-release\activity-stream.discovery_stream.json.tmp
                                                                                                            • Size 24KB
                                                                                                            • SHA256 c42dee2e6e576e00f3a49e3b92594a1e3cfd047a6ac24efb7867de7e29d61808
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tdlob5bw.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                                                                            • Size 13KB
                                                                                                            • SHA256 0666cb47378ad07d09a22009bf7cf960568c20e84b49faccbcf99d7d281cedc9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            v7942.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                                                            • Size 1.7MB
                                                                                                            • SHA256 e5186a04536313599bea259d6fefac44b168d81e08dcc36e54b2c6ff08374efd
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            alex1dskfmdsf.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                                                            • Size 1.1MB
                                                                                                            • SHA256 630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            Bell_Setup16.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                                                            • Size 2.0MB
                                                                                                            • SHA256 701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            bot.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                            • Size 7.6MB
                                                                                                            • SHA256 b4249c18a2587aa815f54a2e67f1a259659822ff35540576956857d8085e6a2f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            kololololo.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
                                                                                                            • Size 1.2MB
                                                                                                            • SHA256 5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            2a8bdb876e.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10046300101\2a8bdb876e.exe
                                                                                                            • Size 4.3MB
                                                                                                            • SHA256 eab57fe16344a4a935192a58a4a539c57735bdd423206e58070f1f51b17648b0
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            SPOKz5U.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
                                                                                                            • Size 1.9MB
                                                                                                            • SHA256 f2792c40162c59b66afea7f6deef975afdce331d51da1a6487e558b30d7db4cf
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            nAM5wkr.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10385170101\nAM5wkr.exe
                                                                                                            • Size 180KB
                                                                                                            • SHA256 c0fad729097860c1e9777f60c6519c3a772b005b4c6c990534e17a9c51b2d755
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            bprz1VA.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10386410101\bprz1VA.exe
                                                                                                            • Size 11.2MB
                                                                                                            • SHA256 fe0b20c7595251a2b626f8643c29ada476410ddc9d87b9c4dc84f637fe99dc95
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            gLLOqKC.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10391640101\gLLOqKC.exe
                                                                                                            • Size 1.9MB
                                                                                                            • SHA256 70644ea317eba869340837f59f70987abac16b2a10a6a70a153130c6d0915707
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            apple.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10392050101\apple.exe
                                                                                                            • Size 327KB
                                                                                                            • SHA256 98d2ce957150f0163bc11537b259e37fda34304aa39702a331fad8070dbf97b5
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            a6ae6d0ba4.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10392901101\a6ae6d0ba4.exe
                                                                                                            • Size 668KB
                                                                                                            • SHA256 cd167aa1a3248d13d2bcc69cbe52e4b70d908906d33fcdd8efb6ccaa0c3f56a1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            Natsu.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393770101\Natsu.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 3045c4c630d44383a7153d9d13e4cdaa3284095cb580627a9adb0b9e4033d9e3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            amnew.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393930101\amnew.exe
                                                                                                            • Size 429KB
                                                                                                            • SHA256 87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            b15896d78b.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393950101\b15896d78b.exe
                                                                                                            • Size 2.0MB
                                                                                                            • SHA256 bfbcdb499350b8566fe58d488dfb8b8a98d10946bc8e609bfc8fe2955099a67b
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            c3d0fed14a.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393960101\c3d0fed14a.exe
                                                                                                            • Size 1.7MB
                                                                                                            • SHA256 db46bb549810d2ea9c294c5398de8d4748da0a1efc849714ac72fabd04e2cbc9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            0ca9dcca04.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393970101\0ca9dcca04.exe
                                                                                                            • Size 946KB
                                                                                                            • SHA256 35b68fc6adda43d6460ebbe66fad5d4bb4869bb432965c4acccf07b6dae8bbbf
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            6e9bf6489d.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393980101\6e9bf6489d.exe
                                                                                                            • Size 1.7MB
                                                                                                            • SHA256 d9abf17d16e90953e56973bc7553866d9f5d0ced13f29322ec7a3577451a181f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            216f0737c9.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10393990101\216f0737c9.exe
                                                                                                            • Size 1.8MB
                                                                                                            • SHA256 ffca491caacfe1fd3cc6ac243756d9611cd354a03b24752df5825997cdb2d21e
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            2a26d33eb0.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10394000101\2a26d33eb0.exe
                                                                                                            • Size 480KB
                                                                                                            • SHA256 960670b325ad49c1bf269c9816f2c254fa5371f96b3ad7371c5150c49591a3c7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            2a26d33eb0.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10394000101\2a26d33eb0.exe
                                                                                                            • Size 240KB
                                                                                                            • SHA256 79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            e472f1d9f7.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\10394010101\e472f1d9f7.exe
                                                                                                            • Size 4.4MB
                                                                                                            • SHA256 f3978a907e9afb0c69059a295212eefda54289fbbbbfafec1f452792ae5287e6
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            221.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\221.exe
                                                                                                            • Size 88KB
                                                                                                            • SHA256 4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            Built.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Built.exe
                                                                                                            • Size 8.2MB
                                                                                                            • SHA256 0705041d5f680ce4dd9e8d472f2dadd04f3802dc66fb01f8e1fc6f5a6a3eecc2
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            3V83o.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3V83o.exe
                                                                                                            • Size 1.8MB
                                                                                                            • SHA256 c92f3f57e1bc9e19a4f8f1e08b15513f9e0bbaaf20afd431878e1eb31e99d2b0
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            a2K27.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a2K27.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 d4f7a5bed186483e5a7eb8f8efcae4584a39509ea84f5b79027c48cf5c792642
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            1h60C7.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1h60C7.exe
                                                                                                            • Size 1.8MB
                                                                                                            • SHA256 83c18fb1aeabee9c2108288562cef143babeabe3eed9e14eece66cfe7ecfa880
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            2p4752.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2p4752.exe
                                                                                                            • Size 2.0MB
                                                                                                            • SHA256 9a5b27acd03abbcb09e9904343749305c876b5b3d71fcf55c75af5136daaf4b1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            Luma_Crypt_Packlab.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Luma_Crypt_Packlab.exe
                                                                                                            • Size 2.1MB
                                                                                                            • SHA256 4a68f65ec41bd361d2f54fc9d8152a2e6c584296be0eaf302078a2b0cbc881d6
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            a5.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\a5.exe
                                                                                                            • Size 329KB
                                                                                                            • SHA256 b5d16f43ccea833bd704da5382c6d07005d3d549372d343716a0c53f6c51d9bb
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            VCRUNTIME140.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\VCRUNTIME140.dll
                                                                                                            • Size 116KB
                                                                                                            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            _ctypes.pyd
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_ctypes.pyd
                                                                                                            • Size 58KB
                                                                                                            • SHA256 20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-console-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-console-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 af9675ac90bae8a0d8623f6fdaff9d39e1b8810e8e46a5b044baaa3396e745b3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-datetime-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 f918b0c45f59b2cb29f1eb3653d2f2679095e85e082a1198c933a76edf1f33ef
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-debug-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-debug-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 0d859a866d1bcefe1a1bc5adb88dcf2765567ecc31dfb4e472b512d033d88bb4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 189bbbd739526a986e53518865e741cde8c5967aacd5ed687408cec3d8781f1c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-fibers-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-fibers-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 b83a71978215fdba477c4ea61340168947a1021324d118e6b7159054985f2d1a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-file-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l1-1-0.dll
                                                                                                            • Size 25KB
                                                                                                            • SHA256 e55b200643e8b078e7f5eb0c97de44fead21b11d06590ebedbcb84214d063345
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-file-l1-2-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l1-2-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-file-l2-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-file-l2-1-0.dll
                                                                                                            • Size 20KB
                                                                                                            • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-handle-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-handle-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 0a351c2a2889a42886017e7dbcf75f45e3cb24d2f55e72205624272487e4a056
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-heap-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-heap-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 b998ff8d173c34505e1d5984134282866de910b09919cf9a322fce760b75c80b
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 c09eb307b2eb747b73c516267a99a23bb73204452326d41bdeb6f43598f6d62e
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 b3ba83880986f2522d05a88c52fe69eda9c9fadbc5192a063e36bba777cc877f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-localization-l1-2-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-localization-l1-2-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-memory-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-memory-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 db978830b1fbcc0521582a6a79864b0fd83179248fa374926c8097bc02cd6383
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 d078a9a9958a7c816dea989bef24f32befc6651aea5e07f97a7b5d50df73f799
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 2ee9434cc5f40f4514c7284e14b90db5c7a33000afda834d7c1dc063baa3d805
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 ba55f8481d8a9d225b8c430eb010f675250c5afa64d9eeb15ff31dc159a19f5a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            api-ms-win-core-profile-l1-1-0.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\api-ms-win-core-profile-l1-1-0.dll
                                                                                                            • Size 21KB
                                                                                                            • SHA256 c4c1d381f419731c848e4a20aef02a4436758935c9a274896228b9451956cc8e
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            base_library.zip
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\base_library.zip
                                                                                                            • Size 1.4MB
                                                                                                            • SHA256 da04714dbefa733acba1eca9886ca1b34ff584f6d2adf7e6952ec4d64444ad93
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            libffi-8.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libffi-8.dll
                                                                                                            • Size 29KB
                                                                                                            • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            python311.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\python311.dll
                                                                                                            • Size 1.6MB
                                                                                                            • SHA256 28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            ucrtbase.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\ucrtbase.dll
                                                                                                            • Size 1.1MB
                                                                                                            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            blank.aes
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI48842\blank.aes
                                                                                                            • Size 121KB
                                                                                                            • SHA256 05aec2281c4baa17770907ff306c03f9842360e37de6465681c6273a26a7a0e5
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            __PSScriptPolicyTest_ze2pvofv.50a.ps1
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ze2pvofv.50a.ps1
                                                                                                            • Size 60B
                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            _shfoldr.dll
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-UN6QM.tmp\_isetup\_shfoldr.dll
                                                                                                            • Size 22KB
                                                                                                            • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            tmpaddon
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                            • Size 11KB
                                                                                                            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            tmpaddon
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                            • Size 14.0MB
                                                                                                            • SHA256 a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            tmpaddon
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                            • Size 502KB
                                                                                                            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            wow_6262_build (9).exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wow_6262_build (9).exe
                                                                                                            • Size 2.1MB
                                                                                                            • SHA256 06a0c5ec948b65d8377b784b32f0beed36585a0c800b7ef378ed4d2bc6619f66
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            AlternateServices.bin
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                            • Size 7KB
                                                                                                            • SHA256 8a64b718431a5bbc05e3199f1db83a07ed20e9b44dda6d6c44182a8323f09b39
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            AlternateServices.bin
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                            • Size 8KB
                                                                                                            • SHA256 8d195c4e263bc71b192e52393d1b26eeeee6906d7379418bad68b60a935038f2
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            AlternateServices.bin
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\AlternateServices.bin
                                                                                                            • Size 17KB
                                                                                                            • SHA256 f5648a78f9db29c8935f83047061f908c1924c307a3981cb3b6d1e6444f0ac7d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            data.safe.bin
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\db\data.safe.bin
                                                                                                            • Size 30KB
                                                                                                            • SHA256 5f2b4ff5110b30c3c916446f1e7bcc43172ffc876e2e74d1dbdec9abb420d814
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            data.safe.tmp
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                            • Size 6KB
                                                                                                            • SHA256 59765775f2341cad464bf83c50715d681d809f827d068c264679e7e1a7e5d378
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            events
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\events\events
                                                                                                            • Size 1KB
                                                                                                            • SHA256 9035f79633b558076fdf42e061433c60fd5053290e1717253a736fcbbb1dc867
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            8c07fb7e-7bce-46f7-b3ee-ae4afbf5a358
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\8c07fb7e-7bce-46f7-b3ee-ae4afbf5a358
                                                                                                            • Size 886B
                                                                                                            • SHA256 97b54f477a54c61b1faf2a70e20dca5b9b350cbf7d5efe47bf05118088015a02
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            bea82815-e8f6-43a9-9146-50fd8efb9e73
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\bea82815-e8f6-43a9-9146-50fd8efb9e73
                                                                                                            • Size 16KB
                                                                                                            • SHA256 d098c10e55999e19d46ba12d542fbea0b8b567d754bd7b25dee568c5930e5bf9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            e8b55763-14ad-423b-ae31-8e6feb4b2b4b
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\e8b55763-14ad-423b-ae31-8e6feb4b2b4b
                                                                                                            • Size 235B
                                                                                                            • SHA256 2d6c66e3bdbffa52597e375a4bef132a5ce1eadaa4356048a7d470aa90c4d881
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            f46cfde6-0048-4742-9e39-a28df0fc37ed
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\f46cfde6-0048-4742-9e39-a28df0fc37ed
                                                                                                            • Size 2KB
                                                                                                            • SHA256 6edd92c942b7a45a10bedc2109e3d29dd2ef666f8a8ac1413d062d665c124778
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            f8c4487c-7f69-4650-9918-a2cab29aed87
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\f8c4487c-7f69-4650-9918-a2cab29aed87
                                                                                                            • Size 235B
                                                                                                            • SHA256 071c7d392b14e99ede9617d67adf0b8f5c2f343c1c7a44d7cb24030361425f65
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            fad9cc17-ac6c-43a7-a011-e15acd2f65a1
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\datareporting\glean\pending_pings\fad9cc17-ac6c-43a7-a011-e15acd2f65a1
                                                                                                            • Size 883B
                                                                                                            • SHA256 f9122e799dd01bfc4c51dad138ed55b336ecc5f0997239ce9c858a59dceb1ac4
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            extensions.json
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\extensions.json
                                                                                                            • Size 16KB
                                                                                                            • SHA256 56084cf77c211a7a063cc8e0e01624a13cb0df09b6fb73494e8339f0a19c0bd1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            gmpopenh264.dll
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                            • Size 1.1MB
                                                                                                            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            gmpopenh264.info
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                            • Size 116B
                                                                                                            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            manifest.json
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                                                                                                            • Size 1001B
                                                                                                            • SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            widevinecdm.dll
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                                                                                                            • Size 18.5MB
                                                                                                            • SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            prefs-1.js
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs-1.js
                                                                                                            • Size 6KB
                                                                                                            • SHA256 64ad02adc326fe4bbb6c8580d944691011bb5a2b4d775f5f25b5ac986c5478e9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            prefs-1.js
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs-1.js
                                                                                                            • Size 8KB
                                                                                                            • SHA256 bbee792c0c95c7d76da06c7af8dc8a89b64dcc70c25c041cbd9bfe4c9b529899
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            prefs.js
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs.js
                                                                                                            • Size 6KB
                                                                                                            • SHA256 6ee0c92517cacd70f6df2a2ecda6dd2945e8ac0f8fe96fe6ff7945e1991eb0f8
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            prefs.js
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\prefs.js
                                                                                                            • Size 6KB
                                                                                                            • SHA256 239bd20f6a17f4533e7274f39e451a4e5dda661464c6bda67c4f43bf2d43c6e1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            recovery.baklz4
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\sessionstore-backups\recovery.baklz4
                                                                                                            • Size 1KB
                                                                                                            • SHA256 dc0ee2355621e70d867e19ac3515bc14ae3e9a072af75110c419f16f6e9c35b2
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            3870112724rsegmnoittet-es.sqlite
                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tdlob5bw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                            • Size 3.4MB
                                                                                                            • SHA256 6915147403e31e0799dbe346efa10abdd6c405ccd32dd2dd27ff21ae1d102630
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            xdwd.dll
                                                                                                            • Path C:\Windows\xdwd.dll
                                                                                                            • Size 136KB
                                                                                                            • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                            Submit Download

                                                                                                            memory/388-581-0x0000000000A10000-0x0000000000EA2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/388-566-0x0000000000A10000-0x0000000000EA2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/436-345-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/436-344-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/932-657-0x0000000000400000-0x0000000000471000-memory.dmp
                                                                                                            Download

                                                                                                            memory/932-673-0x0000000000400000-0x0000000000471000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1172-15-0x0000000000E00000-0x00000000012B6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1172-28-0x0000000000E00000-0x00000000012B6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1472-1581-0x0000000072600000-0x0000000072B0E000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1472-1748-0x0000000072600000-0x0000000072B0E000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1580-668-0x0000000000400000-0x000000000056C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2240-669-0x0000000000400000-0x0000000000471000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2240-686-0x0000000000400000-0x0000000000471000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2268-609-0x0000000000ED0000-0x0000000001562000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2268-625-0x0000000000ED0000-0x0000000001562000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2316-501-0x0000000000C90000-0x0000000000D79000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2316-469-0x0000000000C90000-0x0000000000D79000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2352-480-0x0000000000400000-0x0000000000454000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-481-0x0000000004DD0000-0x00000000053F8000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-479-0x0000000004650000-0x0000000004686000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-495-0x0000000005C30000-0x0000000005C4E000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-496-0x0000000005C60000-0x0000000005CAC000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-484-0x00000000055E0000-0x0000000005646000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-482-0x0000000004D70000-0x0000000004D92000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-494-0x0000000005650000-0x00000000059A4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2392-483-0x0000000005570000-0x00000000055D6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2440-478-0x0000000000E30000-0x00000000010AB000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2440-303-0x0000000000400000-0x0000000000462000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2440-304-0x0000000000400000-0x0000000000462000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2440-474-0x0000000000E30000-0x00000000010AB000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2616-52-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2616-51-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2684-685-0x0000000000400000-0x000000000056C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2716-1561-0x0000000007E60000-0x0000000007E71000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2716-1386-0x0000000006380000-0x00000000066D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2716-1530-0x0000000006A60000-0x0000000006AAC000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2716-1541-0x000000006E650000-0x000000006E69C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2716-1551-0x0000000007B40000-0x0000000007BE3000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2736-355-0x0000020458A50000-0x0000020458A72000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3032-70-0x0000000000A90000-0x0000000000AC4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-400-0x00007FF870510000-0x00007FF870543000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-333-0x00007FF87F290000-0x00007FF87F2A9000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-390-0x00007FF86A060000-0x00007FF86A17C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-389-0x00007FF878FB0000-0x00007FF878FBD000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-340-0x00007FF86A560000-0x00007FF86A6D6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-341-0x00007FF87F1F0000-0x00007FF87F209000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-395-0x00007FF87C110000-0x00007FF87C13D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-352-0x00007FF878FB0000-0x00007FF878FBD000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-353-0x00007FF86A060000-0x00007FF86A17C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-396-0x00007FF870CC0000-0x00007FF870CE3000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-342-0x00007FF87E350000-0x00007FF87E35D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-354-0x00007FF8768D0000-0x00007FF8768E4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-349-0x00007FF867430000-0x00007FF867959000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-394-0x00007FF87F290000-0x00007FF87F2A9000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-348-0x00007FF883250000-0x00007FF883274000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-397-0x00007FF86A560000-0x00007FF86A6D6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-302-0x00007FF868A80000-0x00007FF869070000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-339-0x00007FF870CC0000-0x00007FF870CE3000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-351-0x000001877A0A0000-0x000001877A5C9000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-347-0x00007FF868A80000-0x00007FF869070000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-325-0x00007FF87FB30000-0x00007FF87FB3F000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-391-0x00007FF87FB30000-0x00007FF87FB3F000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-324-0x00007FF883250000-0x00007FF883274000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-398-0x00007FF87F1F0000-0x00007FF87F209000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-399-0x00007FF87E350000-0x00007FF87E35D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-393-0x00007FF883250000-0x00007FF883274000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-343-0x00007FF870510000-0x00007FF870543000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-392-0x00007FF8768D0000-0x00007FF8768E4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-334-0x00007FF87C110000-0x00007FF87C13D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-401-0x00007FF86A490000-0x00007FF86A55D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-402-0x00007FF867430000-0x00007FF867959000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-346-0x00007FF86A490000-0x00007FF86A55D000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-403-0x000001877A0A0000-0x000001877A5C9000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3052-376-0x00007FF868A80000-0x00007FF869070000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3228-475-0x0000000000930000-0x0000000000938000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3228-476-0x0000000002790000-0x00000000027B0000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3268-306-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3268-199-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-710-0x0000000007960000-0x0000000007A03000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-698-0x0000000006F70000-0x0000000006FA2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-699-0x000000006E640000-0x000000006E68C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-687-0x0000000006340000-0x0000000006694000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-697-0x0000000006F20000-0x0000000006F6C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-715-0x0000000007B30000-0x0000000007B41000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-714-0x0000000007F50000-0x0000000007FE6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-713-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-711-0x00000000083E0000-0x0000000008A5A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-712-0x0000000007A70000-0x0000000007A8A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3328-709-0x0000000006EA0000-0x0000000006EBE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3956-524-0x0000000000750000-0x0000000000ADE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3988-33-0x0000000000DD0000-0x000000000128A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3988-34-0x0000000000DD0000-0x000000000128A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-1700-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-453-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-35-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-43-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-29-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-178-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-553-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-176-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-626-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-174-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-758-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-508-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4384-350-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-1698-0x0000000000A90000-0x0000000000EF2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-734-0x0000000000A90000-0x0000000000EF2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-744-0x0000000000A90000-0x0000000000EF2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-745-0x0000000000A90000-0x0000000000EF2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-1657-0x0000000000A90000-0x0000000000EF2000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4824-529-0x0000000005330000-0x000000000534A000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4824-530-0x00000000054D0000-0x00000000054DA000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4824-528-0x0000000005380000-0x0000000005412000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4824-525-0x0000000000400000-0x0000000000558000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4824-527-0x0000000005A60000-0x0000000006004000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5040-623-0x0000000000400000-0x0000000000463000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5040-622-0x0000000000400000-0x0000000000463000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5460-1836-0x0000000000400000-0x0000000000DFE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5460-1789-0x0000000000400000-0x0000000000DFE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6132-1858-0x0000000000400000-0x0000000000CCB000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6132-1881-0x0000000000400000-0x0000000000CCB000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6192-1629-0x000000006E650000-0x000000006E69C000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6192-1594-0x0000000006000000-0x0000000006354000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6240-1605-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6240-1584-0x0000000000C10000-0x00000000010C6000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6340-1897-0x0000000000400000-0x0000000000DFE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6340-2491-0x0000000000400000-0x0000000000DFE000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6604-1673-0x00000000005B0000-0x0000000000A64000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6604-1628-0x00000000005B0000-0x0000000000A64000-memory.dmp
                                                                                                            Download

                                                                                                            memory/7840-1747-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/7840-1746-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/8048-1771-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download

                                                                                                            memory/8048-1770-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                            Download