dcf86afd771b851e2cec90dd044a7d629a1bda033e2bdafe6c198180d7cf0f15

Resubmissions

04/05/2023, 21:16

230504-z4frlaha9y 3

04/05/2023, 20:53

230504-zpsgvafb66 3

04/05/2023, 20:38

230504-zew3aafa88 8

04/05/2023, 20:30

230504-y97ltsgg7x 3

Analysis

max time kernel
445s
max time network
460s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MossfieldOrigin.exe
Size

33.1MB
MD5

bb48e12db27082f17fbaf07fa1f11276
SHA1

68b4b598a36f9325169a3a5b1c4e00d86dee3b6e
SHA256

83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c
SHA512

f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c
SSDEEP

393216:RVkZDbxDV08qbsvOaNpDBcDsxsbqFlUMFkEli4dqRYVHkFtOv9OBBuX6rYRAqs3s:RG/DpKtzIVm09tX6rYSnyQH1lQ

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	winrar-x64-621.exe

Executes dropped EXE 5 IoCs

pid	Process
1956	winrar-x64-621.exe
2308	uninstall.exe
1300	WinRAR.exe
3560	MossfieldOrigin.exe
6008	MossfieldOrigin.exe

Loads dropped DLL 2 IoCs

pid	Process
3176	Process not Found
3176	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240950437	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r08	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MossfieldOrigin.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-621.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
4432	powershell.exe
4432	powershell.exe
1344	powershell.exe
1344	powershell.exe
1552	powershell.exe
1552	powershell.exe
2408	powershell.exe
1908	powershell.exe
4752	powershell.exe
1908	powershell.exe
2408	powershell.exe
4752	powershell.exe
4036	powershell.exe
4036	powershell.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2364	taskmgr.exe
184	OpenWith.exe
1300	WinRAR.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeIncreaseQuotaPrivilege	4684	powershell.exe
Token: SeSecurityPrivilege	4684	powershell.exe
Token: SeTakeOwnershipPrivilege	4684	powershell.exe
Token: SeLoadDriverPrivilege	4684	powershell.exe
Token: SeSystemProfilePrivilege	4684	powershell.exe
Token: SeSystemtimePrivilege	4684	powershell.exe
Token: SeProfSingleProcessPrivilege	4684	powershell.exe
Token: SeIncBasePriorityPrivilege	4684	powershell.exe
Token: SeCreatePagefilePrivilege	4684	powershell.exe
Token: SeBackupPrivilege	4684	powershell.exe
Token: SeRestorePrivilege	4684	powershell.exe
Token: SeShutdownPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeSystemEnvironmentPrivilege	4684	powershell.exe
Token: SeRemoteShutdownPrivilege	4684	powershell.exe
Token: SeUndockPrivilege	4684	powershell.exe
Token: SeManageVolumePrivilege	4684	powershell.exe
Token: 33	4684	powershell.exe
Token: 34	4684	powershell.exe
Token: 35	4684	powershell.exe
Token: 36	4684	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeIncreaseQuotaPrivilege	1344	powershell.exe
Token: SeSecurityPrivilege	1344	powershell.exe
Token: SeTakeOwnershipPrivilege	1344	powershell.exe
Token: SeLoadDriverPrivilege	1344	powershell.exe
Token: SeSystemProfilePrivilege	1344	powershell.exe
Token: SeSystemtimePrivilege	1344	powershell.exe
Token: SeProfSingleProcessPrivilege	1344	powershell.exe
Token: SeIncBasePriorityPrivilege	1344	powershell.exe
Token: SeCreatePagefilePrivilege	1344	powershell.exe
Token: SeBackupPrivilege	1344	powershell.exe
Token: SeRestorePrivilege	1344	powershell.exe
Token: SeShutdownPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeSystemEnvironmentPrivilege	1344	powershell.exe
Token: SeRemoteShutdownPrivilege	1344	powershell.exe
Token: SeUndockPrivilege	1344	powershell.exe
Token: SeManageVolumePrivilege	1344	powershell.exe
Token: 33	1344	powershell.exe
Token: 34	1344	powershell.exe
Token: 35	1344	powershell.exe
Token: 36	1344	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeIncreaseQuotaPrivilege	1552	powershell.exe
Token: SeSecurityPrivilege	1552	powershell.exe
Token: SeTakeOwnershipPrivilege	1552	powershell.exe
Token: SeLoadDriverPrivilege	1552	powershell.exe
Token: SeSystemProfilePrivilege	1552	powershell.exe
Token: SeSystemtimePrivilege	1552	powershell.exe
Token: SeProfSingleProcessPrivilege	1552	powershell.exe
Token: SeIncBasePriorityPrivilege	1552	powershell.exe
Token: SeCreatePagefilePrivilege	1552	powershell.exe
Token: SeBackupPrivilege	1552	powershell.exe
Token: SeRestorePrivilege	1552	powershell.exe
Token: SeShutdownPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeSystemEnvironmentPrivilege	1552	powershell.exe
Token: SeRemoteShutdownPrivilege	1552	powershell.exe
Token: SeUndockPrivilege	1552	powershell.exe
Token: SeManageVolumePrivilege	1552	powershell.exe
Token: 33	1552	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
3764	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
3764	firefox.exe
2364	taskmgr.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
1956	winrar-x64-621.exe
1956	winrar-x64-621.exe
1956	winrar-x64-621.exe
2308	uninstall.exe
1300	WinRAR.exe
1300	WinRAR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4560	4484	MossfieldOrigin.exe	86
PID 4484 wrote to memory of 4560	4484	MossfieldOrigin.exe	86
PID 4560 wrote to memory of 212	4560	cmd.exe	88
PID 4560 wrote to memory of 212	4560	cmd.exe	88
PID 4484 wrote to memory of 4432	4484	MossfieldOrigin.exe	89
PID 4484 wrote to memory of 4432	4484	MossfieldOrigin.exe	89
PID 4484 wrote to memory of 4684	4484	MossfieldOrigin.exe	90
PID 4484 wrote to memory of 4684	4484	MossfieldOrigin.exe	90
PID 4432 wrote to memory of 4004	4432	powershell.exe	92
PID 4432 wrote to memory of 4004	4432	powershell.exe	92
PID 4004 wrote to memory of 1336	4004	csc.exe	93
PID 4004 wrote to memory of 1336	4004	csc.exe	93
PID 4484 wrote to memory of 1344	4484	MossfieldOrigin.exe	94
PID 4484 wrote to memory of 1344	4484	MossfieldOrigin.exe	94
PID 4484 wrote to memory of 1552	4484	MossfieldOrigin.exe	97
PID 4484 wrote to memory of 1552	4484	MossfieldOrigin.exe	97
PID 4484 wrote to memory of 4008	4484	MossfieldOrigin.exe	99
PID 4484 wrote to memory of 4008	4484	MossfieldOrigin.exe	99
PID 4484 wrote to memory of 4752	4484	MossfieldOrigin.exe	101
PID 4484 wrote to memory of 4752	4484	MossfieldOrigin.exe	101
PID 4484 wrote to memory of 1908	4484	MossfieldOrigin.exe	102
PID 4484 wrote to memory of 1908	4484	MossfieldOrigin.exe	102
PID 4484 wrote to memory of 2408	4484	MossfieldOrigin.exe	103
PID 4484 wrote to memory of 2408	4484	MossfieldOrigin.exe	103
PID 4484 wrote to memory of 3288	4484	MossfieldOrigin.exe	107
PID 4484 wrote to memory of 3288	4484	MossfieldOrigin.exe	107
PID 3288 wrote to memory of 1828	3288	cmd.exe	109
PID 3288 wrote to memory of 1828	3288	cmd.exe	109
PID 4484 wrote to memory of 4036	4484	MossfieldOrigin.exe	110
PID 4484 wrote to memory of 4036	4484	MossfieldOrigin.exe	110
PID 4484 wrote to memory of 656	4484	MossfieldOrigin.exe	112
PID 4484 wrote to memory of 656	4484	MossfieldOrigin.exe	112
PID 656 wrote to memory of 1844	656	cmd.exe	114
PID 656 wrote to memory of 1844	656	cmd.exe	114
PID 4484 wrote to memory of 3660	4484	MossfieldOrigin.exe	115
PID 4484 wrote to memory of 3660	4484	MossfieldOrigin.exe	115
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3784 wrote to memory of 3764	3784	firefox.exe	126
PID 3764 wrote to memory of 2724	3764	firefox.exe	127
PID 3764 wrote to memory of 2724	3764	firefox.exe	127
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128
PID 3764 wrote to memory of 232	3764	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe
"C:\Users\Admin\AppData\Local\Temp\MossfieldOrigin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zjegtbj0\zjegtbj0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A22.tmp" "c:\Users\Admin\AppData\Local\Temp\zjegtbj0\CSC1CC05EDBCE114BA9BB2A9F182B098DE.TMP"
      4⤵
      PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:4008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
  2⤵
  PID:3660

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.0.1796179971\187183156" -parentBuildID 20221007134813 -prefsHandle 1832 -prefMapHandle 1792 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e745f938-763a-484a-97b3-0c5c600b8be6} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 1768 19278e92e58 gpu
    3⤵
    PID:2724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.1.1816460376\2103308849" -parentBuildID 20221007134813 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55c561cc-004c-414e-a74d-6eb340f53638} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 2300 1926ae6fe58 socket
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.2.1130665173\1866111853" -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf7cbe3-30ce-465e-9f0d-03376d2a13b3} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 3036 1927baefb58 tab
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.3.1724184155\1270922075" -childID 2 -isForBrowser -prefsHandle 3276 -prefMapHandle 3408 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3d5d058-dba8-44f7-80ca-54d21c784de5} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 3216 1926ae66558 tab
    3⤵
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.4.136981767\1977263199" -childID 3 -isForBrowser -prefsHandle 4072 -prefMapHandle 4068 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ba2ad73-391e-42a9-af4d-6225da811795} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 4080 1926ae5e858 tab
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.7.1648066148\889289399" -childID 6 -isForBrowser -prefsHandle 5040 -prefMapHandle 4964 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7567c9f-799d-4646-8328-29ce357d8c95} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5236 1927e296258 tab
    3⤵
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.6.665357058\622600785" -childID 5 -isForBrowser -prefsHandle 5004 -prefMapHandle 5016 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daa8031c-f8ce-4dec-8ce4-84aaf36461a1} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 4964 1927dfa1b58 tab
    3⤵
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.5.1949582637\512442229" -childID 4 -isForBrowser -prefsHandle 4688 -prefMapHandle 4824 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03e81baf-62e6-4fea-98cb-338d91e9651a} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 4892 1927dc86e58 tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.8.636144875\1613430654" -childID 7 -isForBrowser -prefsHandle 5944 -prefMapHandle 5948 -prefsLen 27174 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e026de0e-965e-4992-bc99-c1659a4cf112} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5936 19277a1db58 tab
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.9.1025368774\934467630" -childID 8 -isForBrowser -prefsHandle 3008 -prefMapHandle 2916 -prefsLen 27174 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {734925b4-0702-45b4-8e16-ab61924a85c6} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5316 19279584c58 tab
    3⤵
    PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.10.713687811\514580563" -parentBuildID 20221007134813 -prefsHandle 6392 -prefMapHandle 6384 -prefsLen 27174 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86ebc615-062e-40ae-b5c4-7bc0eb65640d} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 6396 1927ee23258 rdd
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.11.1984015999\706240450" -childID 9 -isForBrowser -prefsHandle 6620 -prefMapHandle 6616 -prefsLen 27174 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a808e50-b025-4bac-8671-eb50d6582325} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 6648 1927eee0558 tab
    3⤵
    PID:1912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.12.1443516827\346178285" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6844 -prefMapHandle 6848 -prefsLen 27174 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9abee64a-4f77-40ef-825b-c510f2dbea72} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 6780 1927eedf958 utility
    3⤵
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.14.895310832\1190557947" -childID 11 -isForBrowser -prefsHandle 5052 -prefMapHandle 4920 -prefsLen 27349 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {414cc339-2d0d-4222-bc89-a22337e16ef7} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5076 1927dccc558 tab
    3⤵
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.13.1532499356\1285858988" -childID 10 -isForBrowser -prefsHandle 5244 -prefMapHandle 5124 -prefsLen 27349 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52384cb6-c7e1-49d6-8244-9cf413dc893d} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5312 19277b44158 tab
    3⤵
    PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.15.1148566870\801397218" -childID 12 -isForBrowser -prefsHandle 6372 -prefMapHandle 5480 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85ef0990-f0c6-4e88-965c-21613cc53576} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 5520 192801f4f58 tab
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3764.16.656875626\107184023" -childID 13 -isForBrowser -prefsHandle 6752 -prefMapHandle 6748 -prefsLen 27389 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64c65f6e-8c9a-4d53-b477-239047aea125} 3764 "\\.\pipe\gecko-crash-server-pipe.3764" 6724 1927eedff58 tab
    3⤵
    PID:4648
- - C:\Users\Admin\Downloads\winrar-x64-621.exe
    "C:\Users\Admin\Downloads\winrar-x64-621.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Registers COM server for autorun
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:4852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2348

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\MossfieldOrigin.rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Users\Admin\Desktop\MossfieldOrigin.exe
"C:\Users\Admin\Desktop\MossfieldOrigin.exe"
1⤵
- Executes dropped EXE
PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:5152
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "
  2⤵
  PID:5236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2lnfhw4m\2lnfhw4m.cmdline"
    3⤵
    PID:5572
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B2.tmp" "c:\Users\Admin\AppData\Local\Temp\2lnfhw4m\CSC781EAC4C8F5C4B8FBB7E93A011299D6B.TMP"
      4⤵
      PID:5608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:6092
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:5500
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
  2⤵
  PID:5684

C:\Users\Admin\Desktop\MossfieldOrigin.exe
"C:\Users\Admin\Desktop\MossfieldOrigin.exe"
1⤵
- Executes dropped EXE
PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:5204
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:6116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); ' $consolePtr = [Console.Window]::GetConsoleWindow() #0 hide [Console.Window]::ShowWindow($consolePtr, 0) "
  2⤵
  PID:6132
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upvyrzxv\upvyrzxv.cmdline"
    3⤵
    PID:5292
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EBF.tmp" "c:\Users\Admin\AppData\Local\Temp\upvyrzxv\CSCABF958FF552E46B49C6A6C1CB82F8F7C.TMP"
      4⤵
      PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:728
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:5816
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" list vms --long"
  2⤵
  PID:5976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Rar.txt

Filesize
109KB

MD5
e51d9ff73c65b76ccd7cd09aeea99c3c

SHA1
d4789310e9b7a4628154f21af9803e88e89e9b1b

SHA256
7456f489100ec876062d68d152081167ac00d45194b17af4a8dd53680acfc9bd

SHA512
57ab82d4a95d3b5d181c0ec1a1a1de56a4d6c83af5644032ff3af71e9bd8e13051ae274609bda8b336d70a99f2fba17331773694d7e98d4a7635f7b59651b77c

Download Submit
C:\Program Files\WinRAR\RarExt.dll

Filesize
659KB

MD5
4f190f63e84c68d504ae198d25bf2b09

SHA1
56a26791df3d241ce96e1bb7dd527f6fecc6e231

SHA256
3a5d6267a16c3cf5a20c556a7ddbfc80c64fcd2700a8bfd901e328b3945d6a1a

SHA512
521ada80acc35d41ac82ce41bcb84496a3c95cb4db34830787c13cdcb369c59830c2f7ff291f21b7f204d764f3812b68e77fd3ab52dfe0d148c01580db564291

Download Submit
C:\Program Files\WinRAR\RarExt.dll

Filesize
659KB

MD5
4f190f63e84c68d504ae198d25bf2b09

SHA1
56a26791df3d241ce96e1bb7dd527f6fecc6e231

SHA256
3a5d6267a16c3cf5a20c556a7ddbfc80c64fcd2700a8bfd901e328b3945d6a1a

SHA512
521ada80acc35d41ac82ce41bcb84496a3c95cb4db34830787c13cdcb369c59830c2f7ff291f21b7f204d764f3812b68e77fd3ab52dfe0d148c01580db564291

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
103KB

MD5
4c88a040b31c4d144b44b0dc68fb2cc8

SHA1
bf473f5a5d3d8be6e5870a398212450580f8b37b

SHA256
6f1a005a0e5c765fcc68fe15f7ccd18667a6e583980e001ba7181aaaeed442b8

SHA512
e7f224a21d7c111b83775c778e6d9fa447e53809e0efd4f3ba99c7d6206036aa3dde9484248b244fb26789467559a40516c8e163d379e84dcf31ac84b4c5d2a8

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
317KB

MD5
381eae01a2241b8a4738b3c64649fbc0

SHA1
cc5944fde68ed622ebee2da9412534e5a44a7c9a

SHA256
ad58f39f5d429b5a3726c4a8ee5ccada86d24273eebf2f6072ad1fb61ea82d6e

SHA512
f7a8903ea38f2b62d6fa2cc755e0d972a14d00a2e1047e6e983902eff1d3a6bca98327c2b8ed47e46435d1156816e4b0d494726fce87b6cbe7722f5249889b88

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.4MB

MD5
46d15a70619d5e68415c8f22d5c81555

SHA1
12ec96e89b0fd38c469546042e30452b070e337f

SHA256
2e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781

SHA512
09446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb

Download Submit
C:\Program Files\WinRAR\uninstall.exe

Filesize
437KB

MD5
cac9723066062383778f37e9d64fd94e

SHA1
1cd78fc041d733f7eacdd447371c9dec25c7ef2c

SHA256
e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad

SHA512
2b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
8320d09cafbfb3c7313aa0a6d4625409

SHA1
8443d0a2b8b6ea2daa58da36118bafcecf63a00c

SHA256
0a35b5ae4a89891ef210de6c62f7f5dbc693df161c609569b77d51e1f7559939

SHA512
b9d084546401970219d779ac73008ddcfd58d5124437ccc7d24390fcb789b83ab97e15cf1421699985cfd30b8c49ee80ef5e06affc4fee3ec9f2e32e15936a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2f87410b0d834a14ceff69e18946d066

SHA1
f2ec80550202d493db61806693439a57b76634f3

SHA256
5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

SHA512
a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
054c78a4e31542aaae760f4640b9e79b

SHA1
ceeab34d0d612af9ddf7293bdcaf8e3b8a7d590b

SHA256
37d8648ec06e0f1a021e2181129c264ce4d17c18f6eb0f0125f0e18e6d100d7e

SHA512
f615e7781c5dd53f42bb80d2e59932307640426579eb35e4c0ff2af7f817e7b0ef5b431301b79668f5e5f811fc102f6bd62227990bd5ddcef5326258036ea273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
bb1e374dc787045369ee3a25b518487d

SHA1
86b02dc0a9a979eac2779bda8b87a6d3cbcf1402

SHA256
c1ab4aa321685b21c705b058585eb3d62da5a315dbcee6b4c599a993748ecfc3

SHA512
22fb5d7ba16fee753b8390b4063451d83cae8d1e970a22299ea3b6c05b0ae5094c9743fd5ab76dfcfde31d76f0b3b160cbe236c51a51a1d1d13c5800e091ec2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
0356fa5b54b900471d295eb9a5d61a8f

SHA1
8bfe0b83d521f20e4d4b6c6efdab0a10e185648d

SHA256
d19bd3f806d6253ea70de2590655606d7feae9854631ae2eacee56a5dcc13d40

SHA512
dbf47cccd277be16f554e5c5edb1907ba97df39d19980bcafce7d3cd22b772afb8730348e0fa68e32bf2655f0ea74467bd5655bc4d3f61b6edcc729b4b4330ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
1KB

MD5
851bd2dfe83145a4b7e0a2b8dbc40af2

SHA1
deace1a92be40a0fe3ce80d2d9ec93f736cf138c

SHA256
c45382728b3fd60294692a5036ea42dcddd9ecdb7b590d2cc829ab2d99b8977c

SHA512
bba9a5dd34c6a0120ccc39e6d4d38b616185898ee6317182a0af0f9667701447887ff94d68bb4ad03dc2efe391f8735333ba4f0bef25953415e6ed4e7ce438dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
6217955f769d7b63df36e89251bbdf03

SHA1
1cce4c1d32bd66b966a4a71e4225be823278f0dd

SHA256
3df109d58ecc67bb2333276471ba5145e31dfa00cdc405a0723acdc6a8b226f4

SHA512
08859e754d3ac1fa370feae69293a5d512f0449b5e9e7423ca7152f397ad0e56fd7638f6f454d449f672f360c322fc198a0fc9df90e0a1ac3f582427fc6db7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
acc771595f46364e37a02745fd7383f8

SHA1
e7674b0c8c394e1fd9b946255e8790ce04b65e24

SHA256
8bfcd077e00cb667ad6dd9c013c3d1f33b9340f620fa2a16ab63205d2b4ae4b9

SHA512
e11f34a6da0f8d6d253fc0d3aad614afbb0635fbd6ad56d5e9cfd5f973b9437c59235e5ccdebe190e3b279bc7d226c5b291c6561ee3de4ea047b27f222442a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b74def70527ae608d7334966959027e7

SHA1
55acd9c82c894b6532d6795ee8a26208b61233b5

SHA256
37a9edfaca70e556651a07a91aa37261c06c6bd5ac9c99847d7aee897d863153

SHA512
5f355758df2aa329b69a32933fc1753dbfbd6943aa639f9f89819d504a9c07a04d0c84501a21d9579d289dab3d775e2687f86ee8fe5ca9afae54a3706b9beec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
011d2a4465149e907562f78a7e36c612

SHA1
391a1771e621a146d4b80a72b2f3d77f77168e4e

SHA256
c2c8064ceab063292692daee51f2e629d7411b8eee7e9aeb4841039149ec2133

SHA512
8a4121128236da04f1189b77f144a773e32a5b41d3092c5fd75947a69bc213e9769dddbc06ee8eca289f2352a9c9297e9dad9b4496cd79c7cf8da8a794aa8f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
f614ab3ac83b6bfc43fa328850199e18

SHA1
0776e408481fc82612855910ba82d1414f5aae6b

SHA256
0cbe4390612ab2fc1a1adfbb1638e61eb6ff46126889c8574a6d81fd877ed791

SHA512
bde89f115d42619f58aaf9256096cc87d23b12e468b808957997feedb6f5cef93c1652bae342a70ca830b89c048ce9f9d003a93a3cb6075ef8d0b0fc220fd102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
663996be4485686c54ee6b6052c21a13

SHA1
665e3ecf043414c11fdff02f39681960e245e447

SHA256
8df3845cee3ba493380f8522a8c1b42d7552249262dd88eb8e60f3dc8fbf3a64

SHA512
bd4b660aa6d487eef9c65ee69e2ab75cb1edd87bc0dce35269de24e9869791b93c398e1ad811d263b5198bec2818b602e4420792c2890bac561af021bb9b85dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b8c51bad250989d4eb75de6e60dcf34d

SHA1
38b144d21af0b0196fc59ceccdb792da5d689256

SHA256
27772c2c6e40e5ec694a8940b789c9644b1051981fa180a768f844ec743e9e06

SHA512
0345c56eaf4207c86a1247e91ffd1b6bc7e5f25f6703b7c0e083521c76ba80b75bb548c45363d2e0d73397e7be32a445f8e68db69ba7e6ea7de6888b2fcebbf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b8c51bad250989d4eb75de6e60dcf34d

SHA1
38b144d21af0b0196fc59ceccdb792da5d689256

SHA256
27772c2c6e40e5ec694a8940b789c9644b1051981fa180a768f844ec743e9e06

SHA512
0345c56eaf4207c86a1247e91ffd1b6bc7e5f25f6703b7c0e083521c76ba80b75bb548c45363d2e0d73397e7be32a445f8e68db69ba7e6ea7de6888b2fcebbf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
bd106e04a746749f8e573cd8514b1032

SHA1
bb74946cef6172cb2ce8e50ed2672a7620eddb6b

SHA256
acd72fb754bfa956eaf56f25c584afb63ff2d4da408c1cbf35632482ecb88c00

SHA512
2f52d852d04ce52db8633b8e47941e2c7de711e08a240ae2d719487500733d8ad670ac834b128665b3956f83f0be7369ccbed6a9c39590badda717f539b5e1ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
bc59db3485bd09303c2ac893ebcc6d02

SHA1
355d95faa229852860e737af0da22dcfa8c551e0

SHA256
943f1beb2217cfee666531db4ab3f2304ca3faaf31dbb905118d590a1c11a6f5

SHA512
b1ae5772b89b47acad39ecd91aae60e53a907143c10fd0ad3c51eeeb31949ae957cc2309a8ac73491302abc87bb32a71388f7b6f2500e1b0ddc4282983046347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
7a033205a377cd8ed5c2727d58145286

SHA1
2b03ea66739fb68b68df6ab1d784b943b670f10f

SHA256
1e666dc3d95545bf55cb305179f523a4f1eadf1d9e9686caf421aa1026ddc171

SHA512
a08a51ce24aa2cecf70d7a7a382e94a8fc4759b9c0ea996928900dc1d8b635be696dca285646e60c73249ee2008f2910b8f2821ad1caaadeac8bac60655b674e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
04147da99393a78ebbab40599e09ddca

SHA1
cc74792b5cff744ed4e879771b9152b5534e895f

SHA256
d0022634e27f2c60b70c62bd6e3e441e22f139b3e02ebc29d0710f44dc1a54f7

SHA512
82016225b59cc29c3e65609ea62616810f85c84090eb43e4a8bb2ea8834b7691b4476bf94dfdbb009310b69de21ed778e63d550bd8c879d459a0d81d7f60d61d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
19dba8fb1ad5b5a981caeef0afb594b4

SHA1
7669dfd0e39e363109cd59b650fa996169b55f6b

SHA256
4194bedcd7a436104b35457fee797cc2f493d797ff291a44dbd966f8d0e9435e

SHA512
67b3353326e048c498e16302ab9932c2da674f54c4b6930b4c35336fc49df18195a300a1546e66cf4d93887da2b9a9314421829fcb0100926a75c9305afb62c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
19dba8fb1ad5b5a981caeef0afb594b4

SHA1
7669dfd0e39e363109cd59b650fa996169b55f6b

SHA256
4194bedcd7a436104b35457fee797cc2f493d797ff291a44dbd966f8d0e9435e

SHA512
67b3353326e048c498e16302ab9932c2da674f54c4b6930b4c35336fc49df18195a300a1546e66cf4d93887da2b9a9314421829fcb0100926a75c9305afb62c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8a08a37f3de0c9e46cd41ef7d46f03eb

SHA1
151a9c3fe13777cebe8a6ce85450963bda49a1dd

SHA256
c53d5fa354e2a158b30a761bf1cac2ac806805a2cd795521ec86f2639f6307d2

SHA512
4c0411df823d900de524bb6bcda6a63936857f767d913081b6c08e5c6a6da4d6e4c6226163c30ca847f6f1afec3fa82ad0eed2dab06312efd21b23366752ccb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bd8406787b8466c75192dc017809f7a1

SHA1
b82319a42443cad7d91797c164ce40bcd09ffc64

SHA256
412864c3ee14f4103ea240b8cb4492790568cd2056455c3bcbce1a619371eb5f

SHA512
2ef21d5b66238d55d81c0249f6619f155fb90dcfabf45a4c033d64b2f53e416a83248febca0b1fbb4d7adbba58f90662a221e92ab742893ac22e3d163b04a259

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
f4acb4052f2d1b0be162789dce069b32

SHA1
9112673c65afbb18c2616004d668958c551e4900

SHA256
4963c93ed1903e3b9d7abee89b3d15bf8c20c9a390f1c4756561e0d7c5cb51cb

SHA512
5e45b0954e0b6f010b5079c20c578fb7a01ac892c95abcc02a2b5ef076dc68d99c8d1dc0350c1beae289f8e290f152f6d6dafe7470569a8e60f8f17bcd9aa42a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\13220

Filesize
4KB

MD5
63e1a83771cd8a3e39cfb0d6f3c8b2a2

SHA1
60784d64fed16a7c24d5910f0eb55b53b1289a92

SHA256
729c69ef03be78210ccb2bfc3279023dfafc20e459c8c032b6155821234cb2cd

SHA512
6147d2e5c6fdbd4f8ec6b5cbb2e93722ec0aba48fd0b212d441838c4d89d7b8b5403cc604f37f03957b8cec8f9c5998ffca471fed817c56e43a70337f90962e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\23632

Filesize
9KB

MD5
2523da4394fe79bffc5926c3fa014336

SHA1
4c972e2f938862b60d09a515381091775b75789f

SHA256
2e4f5ed365be38241de526ff3eca90c85f983ce8579965b1b31be6f12c8d09a8

SHA512
5dee1fe71aa5c88070060284e2474814f83c5ff1aa168c8efadb85aeaadf0b856b9090e36062aa143a7f40efa3f17074b4f7e17469e441973f0de658c673741b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E

Filesize
14KB

MD5
6b330e3b8f1482fa1c88f25031239d6d

SHA1
8ede1380234eee6fcf1c48366dc9ab7139591347

SHA256
d8c1ca1b0533f76d29629d788a04af6f8e9329cc65f55c0e335118f3cccf86a1

SHA512
242813651d658d6ab8c6f33c813ce8fe60345e8500c08a9bb0fe7e2d59d50a91ed5d87eca7482d358b2c92a44d04fe0542a59935ca57483d5705d0f9648b81d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2lnfhw4m\2lnfhw4m.dll

Filesize
3KB

MD5
6bc8d41e9e288a01a5498d1593028eee

SHA1
338ea74b5ca9e5b8b35d7ba5fb7d90e83e91a7a9

SHA256
71abc41373497fbf119859a877af7a322dc0ba2df7f6b5853bda028073934ba3

SHA512
eb4fcf8d7e809f90aadf1a75edbd7263ff0147bda421c8298b295f3c586c8386249781482d575a7d1f14f28beb240eb6442cd762a2b370b08df4be6f1b720620

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2B2.tmp

Filesize
1KB

MD5
9d940deb39e71bf5f1783ddf2ae2579b

SHA1
80e8c9a6d7f4f03c7f030696642799f96f80b8c2

SHA256
467c769754405cca8d97b30c2799e1b98c1fcd0be83bc1ac7998764966972328

SHA512
a4b89513695a64bff2afa97dd0e5f58ff91ed57bb3a6fe07f8234a5cf08a7f201a2131fecbe2664069d30041a27f1a8c2332ffaeb48ce8865a2d14c2dfdc31f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4EBF.tmp

Filesize
1KB

MD5
92e7d36fae7d5d94339e5a286a997a54

SHA1
515e21b6b21fd3b909b3bd231d4acf2101a8cdfb

SHA256
d70caed3d1cc1c2e62a8da9e83373878ecb541851658175c98b272663525f434

SHA512
f110654cda04ace69d775915209c5269e8d72a2401d84801cb22972578b14491c7eb5f40a3121fc1b2582b095fb781aaf4c9b60ef721a2287365ba0996f18e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9A22.tmp

Filesize
1KB

MD5
ca28ac15743f193dcc6c8e6d0ed7cf2d

SHA1
f1345a3ba2e54007e54e946dcd826e611552455d

SHA256
e90504e9c59238a2c3bd20d3b8a3daf8a22afb8b4298c06584c81af17f584d7e

SHA512
8b3cf1d42fa960ac96019166074a3f5b8828029de12a584bfb0c813d51cfb44aa025db434d8605a60d78a1d1023377a0981ca0c2181e80b57e68a76e339408c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5muy3pn.yt0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\upvyrzxv\upvyrzxv.dll

Filesize
3KB

MD5
94a04020c8835237ccfd47cacbe2a5fb

SHA1
66f68d7a35ad2754afdf20b5e4458f2525e0b724

SHA256
73f9f700ae406e5dc5a1c9e81199bae083b5fa741f9cea1fdc9200dc9b3f8526

SHA512
e6dfa827e1b068e36e0d8ef23780ca8553f3d833b624a2eef7a1d5480a7d74b1c55bd8e241f4a151c39275cdefd7e3e0dad543c776d30e9152a95008c1cf4539

Download Submit
C:\Users\Admin\AppData\Local\Temp\zjegtbj0\zjegtbj0.dll

Filesize
3KB

MD5
8750731e6c1a8e6e1ba2495580f34a6c

SHA1
8126b2ca7bd40a78108a0100cbb944e8d15c97f7

SHA256
225e84ac90d9c2aa9726fa29af1c2fef01402b54036157a092b8afc620daf4c3

SHA512
7abfadba4ae63b67bba5baf2530ffa09b5ffd37eaf2cd6072cfbfa847559392b69d0ff07f1bc7b3093ceca25e20001f7d89d6e5ba9655da11b524cdd2587e4ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
d99a0e7b40828f085508a531cdc0e26a

SHA1
63e2173a3fbf6ba599d7b0477d61865174106f3f

SHA256
1a311b1fe53bccc589a2a90a7f68ea9b23376cb95bc6c113ed369951541e2ee1

SHA512
3ad11d3cfb8b842f57c103a3a18d5cf2f3d3a9e98a318a586be944c90c95ec08a03609c32fb0d0be6a1738d430a5c0d4bf4338e175ac507ada532375d153c607

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
025ce00db4b85695c66162daf757c206

SHA1
6dded335f4587619ff737ce8e703faee764055db

SHA256
13bb6682a052b7b6026b79a025d69ca7a32183e13770b658bbfe3586ad19e6b0

SHA512
2b5869068ff7ef49ddc4688445f356ff6d1c0b3fd5a0bc2724769d91de34d9e2abc0779f249e11f7891588a1c53054f09dccc2c9539d7ef1746755290f3bb7f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
025ce00db4b85695c66162daf757c206

SHA1
6dded335f4587619ff737ce8e703faee764055db

SHA256
13bb6682a052b7b6026b79a025d69ca7a32183e13770b658bbfe3586ad19e6b0

SHA512
2b5869068ff7ef49ddc4688445f356ff6d1c0b3fd5a0bc2724769d91de34d9e2abc0779f249e11f7891588a1c53054f09dccc2c9539d7ef1746755290f3bb7f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
3dca5c56e6154ca177af8c8e7862918f

SHA1
ff8760bbbe79f4a32e89c17f141bb5ffa0e90212

SHA256
0a1d87b583a9464082cb7d4ba1b0c7edc7f0aac1cdff500797d9860aaa38398b

SHA512
b4c3087a8da7fc881fe72081b038568c09caa96ad6689fe27578be988a7fe25d5fa91299c1b7991efa9424ff6710aef6d0765a0d4ac1036cb571133ae8d289b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
802dfd3181a268935c44e9a26c106414

SHA1
e5d3981a075c6c95089ffb89d7346dd744550695

SHA256
31273f987d0361af98cc58c83f7dd2041f8d9aae558da79964e95ef9caea342d

SHA512
583a519d48fd72445c46be1e3c89a88a2c4db2eb95c34d1e47465c89ae9ef18a28746622c0de823a06b8f15fe7a83f284a8727014b0a12eef866db7540586ca1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
e1814d898fbe3fcf96cc9054b3095fa5

SHA1
65028e58f7ef1cd51fd244fb1bfca52a779e2a5d

SHA256
09d89ac7aa59d0e97b2b2da4a31832158d01668fe80f83a2b73b0092da75b30c

SHA512
4b9b7698e6473b9ff53215f8550c1c26bce88a1eda8857ae4a6e89502e63a14d869ceb50a70c3049145bec5b0113ad7dd72bcc98b2851b860c5da4afdbb89d7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
5cf3198f867dbad1261e4e899ce2dddf

SHA1
9300aedc57ce8598bc7b184f987a4808b92ed9db

SHA256
c8f4cbd645ca2cd3472701d8d5109df7cf50c50e078df4abad48c1c863788d38

SHA512
abc184b8022166bcf97c7957603d025b30acb23a6d7bccb8267ebf1560549cafc177ecccdb1c19e98ad12e5ccfe51842ffca5de9c8999e092a5dc557acb2fa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
8f13a3a3c1022d4cabc5dd70e8c6f22b

SHA1
0e8ea907cc0c97a31d9b34de7fa865d7dbb74961

SHA256
3e773683ed388f89c347bb6e9cc75b2613463b0fc733a53e06fcee07ae8df0c6

SHA512
5b26feddbdabcf0f27b4f4aa054c05c011a502ce453ab6ce2abe734f81b4026e14e30cde6b1bd8e4b0bd6237a429e8af63ce10bdab7c35c3b23c2ae96b2d1b99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
662b6be6a903603dad75401ebc1ce36a

SHA1
3f742d5a43a506eec74664548765153d834be3a6

SHA256
857a1a346276c00e593d624358672e664bbaed4c01dd0fa458f49185794e80e7

SHA512
401d1048d96defce43ad08962ec62c32779c52317c2b8e3c5ee52e165d4bfe084696deeac2ebd9763a5228e4741a7c64fbc400a6fa7aacb8d64dd955cb363ab3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
a16469435fabc153696f8640f2a26244

SHA1
9aae567cc7667f2c6c3069d92b44445644a4b7db

SHA256
7e6962e216280033d52d897e1a8ac8cf68de1453f71881f0b71188b1166d3d43

SHA512
099cf5e5daf9cb13f2b7733b5348fbb9a2a55fe20387a0bd8ddffe4435e72193865fe0636b3acb9d4b6f8d0e2bbbec5dfcab7618dbd825917fb07cbe27820f52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
458d6033afaf3bc7071aa54aeb17ccc6

SHA1
d8af6a577f0f1d14c8f415d4fa237facc4bdff74

SHA256
a260d0e6f3cec5a75d713744a08281308c72fb91793705f482ad3e664ec4acc4

SHA512
e58fcd6f11602c5d50f09e594f2607792f6c129940e2fdc2ccd94bad6834db229aa7cf0544dfe016167015e6e423ffadab5562c30412888723862535fd630465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
73bc9b71bc90217a22b8dc31ad525215

SHA1
825eaf8ca6bbab56bdbbbf740d2a5d7ba14557ed

SHA256
fe001139f7fc93217645702c5706a2b6feed03404a239f7ce06b2ac0f765834f

SHA512
5ca3d596a5918120b25daf3c128aa79fb3f0f5f200fde56952ea85b8b9134ab97e0355a5a20c8e7a67865f7f362f0b44fb3675648a206ad600ae11e5fff1f9a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
8KB

MD5
d3d41da0a05d0acbb78fb0be609fb06d

SHA1
9c9c6200c924d07f6edc81872b0d505966de3be1

SHA256
e361d52eaeb36a6f06fc3d80f58d1c404421ca826c5a3c25b6d37ae95abe4c87

SHA512
19b20edf4fa7dd04368bf177167a5bea6d1bcd40ab019212463114b29015d184980c3b831907c39cf13ba7db13b0e355abe2ff99db0d7f0b670663c839974f28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
5852d3a00f56cb72b111df8afcc1f439

SHA1
d1274e248a17663e913b947c2a851b5cc9c40912

SHA256
95d07e137c7a91bd604af0de4294529467434f1484e7ac72f41f83e1772b0c50

SHA512
a5bbdd7f5c59e419a439e4e3c83d143226145b7729cafff7693156704d2b3dbc2e11a71eaf28a76efa6a04eb9f4ef0c08eac92843c971d7e1c4c03e702154761

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
1a939fc650f3f57eee984f194eeb3fae

SHA1
6d698fa65047bd01cf114addbbdbaef12115ec1e

SHA256
8065b1a15900c59fd4bbb63d4ca2c5745605c0518d5e248ec2237644df46e5ce

SHA512
583d6291dc2b4a67a1001c93477c39701c096d5a6d25e771bfb3af7a40e99f00c8b8dd61bc22782db2393d854182cd5a8df51df5192849c8c49e5cd987d70ef0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a5a0407ed4eb1d35829d1635fec4eade

SHA1
289e2180741d091106b0d38a643cb2962270cdf9

SHA256
487201d300036e1e37348128161092535f0d54b38e9fc6c5f4a9c50a205974a3

SHA512
44e754a0b212391f40aa9bf7f1cfefd0efc286dc738b45425d904561fc8f141081e1cb9fcd25a25c55a8f7cd187abac192a67cbc1d16347d307c841724fecc36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
cdbbf931eda4377b46fc1b89725d0594

SHA1
8c21716c20f1b9c5f25af21a4e83870a7fc0b329

SHA256
6d7d52ae571ce61a6b10601b693b92ea1d254a9d3b37b0e3121cbe241dd54ee6

SHA512
7dbba49b33719376c47f85983d9b37fee1b39c2a9e57027f8cf81fe1c724b5a9e03955727c766e93a1acc474d0af5ad438a775856f1deb4323e5a23467286447

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\cache\morgue\73\{c359307e-c8fb-4319-b2ba-52bb80a0e349}.final

Filesize
3KB

MD5
6b3b4bfa5937cc2aad0cb5f0881367a3

SHA1
b6f11f947b644b68b06573b5a59eb1e9d4d56584

SHA256
54881d072458853e9dd6401c90341c33305804ae0cb5c174229c9b3d9f27359d

SHA512
ba1b46f58b0ab6cf7f81bfb4e0873426aa1ba2d2fce5d6d49f7827b2382949a66170925200d640af6bbc31efd126c85c4ffbe4a1dc9e03a145f449e89ecaa8db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\idb\2033882197yCt7-%iCt7-%r3e7sep4o.sqlite

Filesize
48KB

MD5
af0d83f8d3dddcad339a56314e453513

SHA1
cdd268c1a100aee5935c27a90add08f518c4063b

SHA256
46c745f9e33258e043933bc8c00f9b0d515ca887c243ecd9b58b770f127b7f31

SHA512
a90d6e0ac376124cd07161442ed7571ae52aaf5efdb164ced0123a2e2a27c4d8c5a5a4af528f4d05d906044818a194bdd50e0b482b0694a002c9ef8b5e35dfb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
8KB

MD5
2284f1f196c46b96734cde9f39444189

SHA1
cdd7b6a03129d759145be77853a9c672b056d9ac

SHA256
22453cc2228db01c64a1c170637ec3299632a9ddf1cea575ae17c4918e320712

SHA512
03584fb2ccb70a8e5c5de95d87d4e41739148591ca863a4cb3ba64281bfaf7bcfa8a99e381a6a535768af1d57e086190321e108672f816e8ad97f1e7165736d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
440KB

MD5
935ff4cbcf3cd7ff48b1844e61101944

SHA1
21b54faa197075ab378abbfc457b0406c6eba24a

SHA256
75bda12f3af434fbbf8a56d1752ed63ed53157d420a2b7a1865e728905b731e0

SHA512
1d2fb83ff9738ddfe4a951b10de5fe51009bb1e32cfdd44914bd91f2b1a53394d5a88c5813f8dcfef595541bf0fcfe4c210cedc791c4e16d152f74af921bcfc5

Download Submit
C:\Users\Admin\Desktop\MossfieldOrigin.exe

Filesize
33.1MB

MD5
bb48e12db27082f17fbaf07fa1f11276

SHA1
68b4b598a36f9325169a3a5b1c4e00d86dee3b6e

SHA256
83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c

SHA512
f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c

Download Submit
C:\Users\Admin\Desktop\MossfieldOrigin.exe

Filesize
33.1MB

MD5
bb48e12db27082f17fbaf07fa1f11276

SHA1
68b4b598a36f9325169a3a5b1c4e00d86dee3b6e

SHA256
83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c

SHA512
f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c

Download Submit
C:\Users\Admin\Desktop\MossfieldOrigin.exe

Filesize
33.1MB

MD5
bb48e12db27082f17fbaf07fa1f11276

SHA1
68b4b598a36f9325169a3a5b1c4e00d86dee3b6e

SHA256
83e7c2cd30fbc3fbb7baa0b997d9fa5bf9ed075a510ba2382be7d6c44006273c

SHA512
f2b37160c99d6512d10eb260759d731636f418bbdca936c317079963cc286fbf09da75724b5c05b25a937cfa24ddca47d8bf7068ee164ebc5f3590532eb4cd7c

Download Submit
C:\Users\Admin\Downloads\MossfieldOrigin.rar

Filesize
11.9MB

MD5
75585857e7d67d7f6ea8d69486efcad7

SHA1
47d360eea0c43a0721875ddd3d451ff9d489b55f

SHA256
dcf86afd771b851e2cec90dd044a7d629a1bda033e2bdafe6c198180d7cf0f15

SHA512
a9c4afcf03e273ba09fa46b08da9c0653bac5384aedd5056cef3cd3e04c240452959c2841b5180d44927fb4c6bdb38115b1192bc6f5803aa8365ddf83bd22698

Download Submit
C:\Users\Admin\Downloads\MossfieldOrigin.sPM2zfSw.rar.part

Filesize
28KB

MD5
cbdd3682646f3db13fd2f52ccaaceaa8

SHA1
98319a61b9a61dda19f67b903ead23fdf954b494

SHA256
172cf223a420bc5639fde239792d5276cb34bfd1000e2fd4fb283c74c5f22714

SHA512
cea9561bd4ee9fa9f979dc9b5d406d372adb156d72ec325505d12de0d5ef00de00d087a29631696d8bc710e6a91b428d83b1367794cefabb8d56e4c97d74a25f

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621._H5169t0.exe.part

Filesize
15KB

MD5
bf9e0f436aa534e0668913e3e95fb1dd

SHA1
b16916dc0c562b85c326333a360edafcf8994ded

SHA256
082b150cf0bfb5e86f8a3dfce0754e4e3ba1ad5496bc83b9679597a8ffdbb7af

SHA512
b49e283a11504f157f30808ca7c2d2f3c74d7cfdccc2cff907ec194dd9c9dbe7194af8eab4c2f461c9df7bf66ca9080adc3349a1a2a15ffdfc34efdd458f8d28

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe

Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
C:\Users\Admin\Downloads\winrar-x64-621.exe

Filesize
3.4MB

MD5
766ac70b840c029689d3c065712cf46e

SHA1
e54f4628076d81b36de97b01c098a2e7ba123663

SHA256
06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219

SHA512
49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2lnfhw4m\2lnfhw4m.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2lnfhw4m\2lnfhw4m.cmdline

Filesize
369B

MD5
9ac2188ccb1ac45395935ebebae1b906

SHA1
5235045e99b1f10362c40106e80f030188e1ef9f

SHA256
470365da6a06cf45dffbaa12f6745645ddab38cd8dd5215814ce578c0e637dfc

SHA512
8060fa9104c76baf2c2d732f54e019bdd1951556591ae6635717e4f48f3983ae66b14b2e6a6a18f60a801361e8c279f03ed439ea25b5b5b4aa25a308165499a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2lnfhw4m\CSC781EAC4C8F5C4B8FBB7E93A011299D6B.TMP

Filesize
652B

MD5
53382ba4478fd3ddb71ad196c98c7c88

SHA1
90859edce4b58b2167a61c8c96a65b894f2ec350

SHA256
76378b7c7585be2d55433958df0e7e8b92dafaaf915cf9c145214d6ed4c9dd20

SHA512
e05d5ddbe97102f1a3415e4b97f6c9e6703231ef2b8af98ddcfa0bb9db5b8ff1263c2a07350edb397470c781d9ab95fc0c41357a2d2ca4b1ce939c2561b8768d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\upvyrzxv\CSCABF958FF552E46B49C6A6C1CB82F8F7C.TMP

Filesize
652B

MD5
47c7fef8f17b374f51e98c6b166ffd48

SHA1
562a206c3b9c0ea4c42bec59f71747cba05ce193

SHA256
378f663d981157057c7a64e52e6e7d94ce95e068539e4c3515596cbe3e4f6518

SHA512
fdc5fcae95768f86c07bfae28b04040fbaf670f28720e0111eba45332aa7f42b41528780ee8966fd94ad8baa076dfd99910ddde64032898d73245625698ed570

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\upvyrzxv\upvyrzxv.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\upvyrzxv\upvyrzxv.cmdline

Filesize
369B

MD5
19cb79af02bcbb2289bd980450a236e5

SHA1
e91d6213b466fdf6aaa3ec2f1f915856edcd472d

SHA256
8712b66be3b64f4c9007dc33f5959a5ea9913a4bb098ff769f009573ab22fa1f

SHA512
70cbc1c65c1f3f622f8047a8c14bf21d4ac9127d8971be647b9d17603ae5f8f485c79a5bd4606212009009ceddf8bdb86b8c2ab0b9ca36056a0dc308597e27bf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zjegtbj0\CSC1CC05EDBCE114BA9BB2A9F182B098DE.TMP

Filesize
652B

MD5
16aedb703f680fba74e66f281c4936f2

SHA1
8ea524e86d553822390db9bcd8286f7b3d7e0080

SHA256
3f40a33fe1e20128bf144cff3796a93a820367448a7e2f922a1036dde2ed8641

SHA512
ef548f95b4b75c5d42c8575871d7a5ccf04d7c55eb20a5d269e67a3d767b353869006d492c4d9c45987fc6eb7bd9854783cb32d15eebffb3bf27c3cd0b158172

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zjegtbj0\zjegtbj0.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zjegtbj0\zjegtbj0.cmdline

Filesize
369B

MD5
f96a8f6558c5f3e04a12d23d030cf2b0

SHA1
da6d1b21d58b2b9335acd92cd8a4bccf87964a9c

SHA256
d7e59d33ba53e0970615aa4b8a5e7b182942ccc99cad6f1b57f2677ad8cb4d61

SHA512
3a54c7493822d297c19a41de9e3900d070f9bfe081485012ece1e039deca5e7ff18164ad448bc5093a0395bbafe22854705f7762e28782c66e1025eb06737e51

Download Submit
memory/544-4590-0x000001F2693D0000-0x000001F2693E0000-memory.dmp

Filesize
64KB

Download
memory/544-4591-0x000001F2693D0000-0x000001F2693E0000-memory.dmp

Filesize
64KB

Download
memory/544-4592-0x000001F2693D0000-0x000001F2693E0000-memory.dmp

Filesize
64KB

Download
memory/1300-4140-0x00000257F35B0000-0x00000257F3A67000-memory.dmp

Filesize
4.7MB

Download
memory/1300-4139-0x0000024FF26B0000-0x0000024FF2E07000-memory.dmp

Filesize
7.3MB

Download
memory/1344-187-0x000001BEC2930000-0x000001BEC2940000-memory.dmp

Filesize
64KB

Download
memory/1344-188-0x000001BEC2930000-0x000001BEC2940000-memory.dmp

Filesize
64KB

Download
memory/1344-200-0x000001BEC2930000-0x000001BEC2940000-memory.dmp

Filesize
64KB

Download
memory/1552-204-0x0000023FC8CA0000-0x0000023FC8CB0000-memory.dmp

Filesize
64KB

Download
memory/1552-215-0x0000023FC8CA0000-0x0000023FC8CB0000-memory.dmp

Filesize
64KB

Download
memory/1552-216-0x0000023FC8CA0000-0x0000023FC8CB0000-memory.dmp

Filesize
64KB

Download
memory/1908-254-0x000001BBFF450000-0x000001BBFF460000-memory.dmp

Filesize
64KB

Download
memory/1956-3849-0x000001AB4E4C0000-0x000001AB4EC17000-memory.dmp

Filesize
7.3MB

Download
memory/2364-292-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-299-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-291-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-293-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-297-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-298-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-300-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-301-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-302-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2364-303-0x000002286C300000-0x000002286C301000-memory.dmp

Filesize
4KB

Download
memory/2408-257-0x00000202DAAE0000-0x00000202DAAF0000-memory.dmp

Filesize
64KB

Download
memory/2408-252-0x00000202DAAE0000-0x00000202DAAF0000-memory.dmp

Filesize
64KB

Download
memory/2408-251-0x00000202DAAE0000-0x00000202DAAF0000-memory.dmp

Filesize
64KB

Download
memory/4036-283-0x0000020256550000-0x0000020256560000-memory.dmp

Filesize
64KB

Download
memory/4036-284-0x0000020256550000-0x0000020256560000-memory.dmp

Filesize
64KB

Download
memory/4036-282-0x0000020256550000-0x0000020256560000-memory.dmp

Filesize
64KB

Download
memory/4432-165-0x00000244FC150000-0x00000244FC160000-memory.dmp

Filesize
64KB

Download
memory/4432-167-0x00000244FC150000-0x00000244FC160000-memory.dmp

Filesize
64KB

Download
memory/4432-166-0x00000244FC150000-0x00000244FC160000-memory.dmp

Filesize
64KB

Download
memory/4684-182-0x0000029CCC230000-0x0000029CCC254000-memory.dmp

Filesize
144KB

Download
memory/4684-156-0x0000029CE4480000-0x0000029CE44C4000-memory.dmp

Filesize
272KB

Download
memory/4684-181-0x0000029CCC230000-0x0000029CCC25A000-memory.dmp

Filesize
168KB

Download
memory/4684-157-0x0000029CE5F20000-0x0000029CE5F96000-memory.dmp

Filesize
472KB

Download
memory/4684-163-0x0000029CE44F0000-0x0000029CE4500000-memory.dmp

Filesize
64KB

Download
memory/4684-144-0x0000029CCC1A0000-0x0000029CCC1C2000-memory.dmp

Filesize
136KB

Download
memory/4684-164-0x0000029CE44F0000-0x0000029CE4500000-memory.dmp

Filesize
64KB

Download
memory/4752-256-0x000001A25DF10000-0x000001A25DF20000-memory.dmp

Filesize
64KB

Download
memory/4752-258-0x000001A25DF10000-0x000001A25DF20000-memory.dmp

Filesize
64KB

Download
memory/4752-255-0x000001A25DF10000-0x000001A25DF20000-memory.dmp

Filesize
64KB

Download
memory/4852-1380-0x000001DFD3840000-0x000001DFD3850000-memory.dmp

Filesize
64KB

Download
memory/4852-1396-0x000001DFD3940000-0x000001DFD3950000-memory.dmp

Filesize
64KB

Download
memory/4852-1415-0x000001DFDBC30000-0x000001DFDBC31000-memory.dmp

Filesize
4KB

Download
memory/4852-1424-0x000001DFDBD70000-0x000001DFDBD71000-memory.dmp

Filesize
4KB

Download
memory/4852-1422-0x000001DFDBC60000-0x000001DFDBC61000-memory.dmp

Filesize
4KB

Download
memory/4852-1423-0x000001DFDBC60000-0x000001DFDBC61000-memory.dmp

Filesize
4KB

Download
memory/5136-4651-0x00000275B43F0000-0x00000275B4400000-memory.dmp

Filesize
64KB

Download
memory/5168-4653-0x00000199EC090000-0x00000199EC0A0000-memory.dmp

Filesize
64KB

Download
memory/5196-4378-0x0000021FE4D80000-0x0000021FE4D90000-memory.dmp

Filesize
64KB

Download
memory/5196-4380-0x0000021FE4D80000-0x0000021FE4D90000-memory.dmp

Filesize
64KB

Download
memory/5196-4379-0x0000021FE4D80000-0x0000021FE4D90000-memory.dmp

Filesize
64KB

Download
memory/5212-4652-0x000002DB68FC0000-0x000002DB68FD0000-memory.dmp

Filesize
64KB

Download
memory/5228-4536-0x0000017D6D700000-0x0000017D6D710000-memory.dmp

Filesize
64KB

Download
memory/5228-4537-0x0000017D6D700000-0x0000017D6D710000-memory.dmp

Filesize
64KB

Download
memory/5244-4210-0x000001D8BDBA0000-0x000001D8BDBB0000-memory.dmp

Filesize
64KB

Download
memory/5244-4214-0x000001D8BDBA0000-0x000001D8BDBB0000-memory.dmp

Filesize
64KB

Download
memory/5244-4215-0x000001D8BDBA0000-0x000001D8BDBB0000-memory.dmp

Filesize
64KB

Download
memory/5516-4617-0x000001C03FA50000-0x000001C03FA60000-memory.dmp

Filesize
64KB

Download
memory/5556-4331-0x0000028906B00000-0x0000028906B10000-memory.dmp

Filesize
64KB

Download
memory/5556-4326-0x0000028906B00000-0x0000028906B10000-memory.dmp

Filesize
64KB

Download
memory/5556-4328-0x0000028906B00000-0x0000028906B10000-memory.dmp

Filesize
64KB

Download
memory/5568-4352-0x00000169F6A00000-0x00000169F6A10000-memory.dmp

Filesize
64KB

Download
memory/5568-4329-0x00000169F6A00000-0x00000169F6A10000-memory.dmp

Filesize
64KB

Download
memory/5604-4325-0x000001EE1A640000-0x000001EE1A650000-memory.dmp

Filesize
64KB

Download
memory/5604-4327-0x000001EE1A640000-0x000001EE1A650000-memory.dmp

Filesize
64KB

Download
memory/5604-4330-0x000001EE1A640000-0x000001EE1A650000-memory.dmp

Filesize
64KB

Download
memory/5784-4238-0x0000021DF33B0000-0x0000021DF33C0000-memory.dmp

Filesize
64KB

Download
memory/5784-4241-0x0000021DF33B0000-0x0000021DF33C0000-memory.dmp

Filesize
64KB

Download
memory/5784-4237-0x0000021DF33B0000-0x0000021DF33C0000-memory.dmp

Filesize
64KB

Download
memory/6024-4279-0x0000017E69DA0000-0x0000017E69DB0000-memory.dmp

Filesize
64KB

Download
memory/6024-4280-0x0000017E69DA0000-0x0000017E69DB0000-memory.dmp

Filesize
64KB

Download
memory/6024-4278-0x0000017E69DA0000-0x0000017E69DB0000-memory.dmp

Filesize
64KB

Download
memory/6132-4538-0x000001BCC9970000-0x000001BCC9980000-memory.dmp

Filesize
64KB

Download
memory/6132-4548-0x000001BCC9970000-0x000001BCC9980000-memory.dmp

Filesize
64KB

Download