eternity | 84bcfb6ffc7f2d05ef0675c2b31c6981a95715c07400389626bea4259d4bdab6

Resubmissions

13-06-2023 18:14

230613-wvhcaaaa58 10

13-06-2023 18:11

230613-wsvvlaad41 10

Analysis

max time kernel
829s
max time network
1054s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2023 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csn_hackv2.html
Size

409B
MD5

72b1976505fae025f4f5a1271dde71d2
SHA1

76be1e871cdfbe31c7bd1c0178c5685eea60813e
SHA256

84bcfb6ffc7f2d05ef0675c2b31c6981a95715c07400389626bea4259d4bdab6
SHA512

da4e935014aae7edfbfa6e6a99b566ebebbfee29c7ee218f8e14015f22243f86ef84ed1caabfed59b7dfb5eb6242839a521d523bdc79c9d1ba7672d7b4bea3a3

Score

10^/10

eternity discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x0002000000023b64-5400.dat	disable_win_def
behavioral2/memory/3784-5406-0x00000000008C0000-0x0000000000ADE000-memory.dmp	disable_win_def

Detects Eternity stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/files/0x00040000000230fa-610.dat	eternity_stealer
behavioral2/files/0x000f000000023190-613.dat	eternity_stealer
behavioral2/files/0x000f000000023190-616.dat	eternity_stealer
behavioral2/memory/3704-617-0x0000000000340000-0x0000000000458000-memory.dmp	eternity_stealer
behavioral2/files/0x0002000000023b64-5400.dat	eternity_stealer
behavioral2/memory/3784-5406-0x00000000008C0000-0x0000000000ADE000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	GrowGuy Proxy V4.25.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	GrowGuy Proxy V4.25.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	GrowGuy Proxy V4.25.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	GrowGuy Proxy V4.25.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	GrowGUY.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	GrowtopiaInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	winrar-x64-622.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WinRAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	GrowGuy Proxy V4.25.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowGuy Proxy V4.25.exe	GrowGuy Proxy V4.25.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowGuy Proxy V4.25.exe	GrowGuy Proxy V4.25.exe

Executes dropped EXE 19 IoCs

pid	Process
3704	csn_hackv2.exe
5268	dcd.exe
2640	GrowtopiaInstaller.exe
5232	vc_redist.x64.exe
2828	vc_redist.x64.exe
1172	Growtopia.exe
5576	winrar-x64-622.exe
2444	uninstall.exe
2836	winrar-x64-622.exe
3484	WinRAR.exe
3784	GrowGuy Proxy V4.25.exe
636	dcd.exe
2692	GrowGUY.exe
5844	firefox.exe
1980	dcd.exe
1396	Growtopia.exe
3736	dcd.exe
4204	dcd.exe
4884	dcd.exe

Loads dropped DLL 10 IoCs

pid	Process
2640	GrowtopiaInstaller.exe
2640	GrowtopiaInstaller.exe
2640	GrowtopiaInstaller.exe
2828	vc_redist.x64.exe
1172	Growtopia.exe
1172	Growtopia.exe
2692	GrowGUY.exe
2692	GrowGUY.exe
1396	Growtopia.exe
1396	Growtopia.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	GrowGuy Proxy V4.25.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1172	Growtopia.exe
1172	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_241132578	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4232	3704	WerFault.exe	108
5620	1172	WerFault.exe	117
2432	1396	WerFault.exe	160
7300	332	WerFault.exe	10
7292	8116	WerFault.exe	231
7648	1608	WerFault.exe	240

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x00050000000230ea-556.dat	nsis_installer_1
behavioral2/files/0x00050000000230ea-556.dat	nsis_installer_2
behavioral2/files/0x00050000000230ea-707.dat	nsis_installer_1
behavioral2/files/0x00050000000230ea-707.dat	nsis_installer_2
behavioral2/files/0x00050000000230ea-708.dat	nsis_installer_1
behavioral2/files/0x00050000000230ea-708.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 402aab7ba945d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.upload.ee	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a9a21fb1134644d82b95f8b75193b5a00000000020000000000106600000001000020000000d919305a3eeb8e259520c083700e73b2267226764cf97508d72f2d97b8059773000000000e8000000002000020000000a52e3c84a4dbbb42d60e85b6948be00fec4c8681618ffdf67e0d8ef2d5e54ecc20000000031eb3be4c15cc12abb5e0d018e776e9761fd45017e8a39da830173d194259cf40000000be3c33f7d054cf5e541907dc2adffce16d92b19b0e1602a27efc1bf03944c25069dd0752df668bb58685c51c51945836966a2c378983c8a2774c558804593274	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{96EF846C-6C2C-4ECA-8E29-68F370B28756}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\upload.ee\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{24CCEBBE-0A16-11EE-8FFF-E63637889D5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039010"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\upload.ee	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4193706596"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a9a21fb1134644d82b95f8b75193b5a000000000200000000001066000000010000200000005fbb4e64b1dd664560637a32d50088ce9ee13d07fa1f975d6cbcbdc5be9ef818000000000e800000000200002000000026f31b33d0a7fee3a312bc81b13810012bfc863e082d23fa6c783f898bdaeda5200000004f0300cf2c83143815c14c3379b7ee0f8b3cea9607a03f484c230f04497487b7400000001ee0d05a6e29bd0031ca1495a6886afa458265003cf555738eaa9b564ee097847430eedeb23c9f5d22cc4a2f88804c1ac249e94ba7b2f8e6714c4cbd85f885c6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393445048"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039010"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\upload.ee	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	WinRAR.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\upload.ee\Total = "32"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108b87ff229ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31039010"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.upload.ee\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d3e7ff229ed901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4193726941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4206963107"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "4"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "5"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "6"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r12	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{CEB56D74-D49C-436E-9EBC-7730D151F3B2}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r27\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{496FDB87-BDDD-437D-97DC-EC290722AA5F}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{A88E611C-5844-44CF-8245-9A291EB10BF1}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\GrowtopiaInstaller.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GrowtopiaInstaller(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GrowGuy_Proxy_V4.25.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-622.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2640	GrowtopiaInstaller.exe
3484	WinRAR.exe
5168	OpenWith.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	3704	csn_hackv2.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	2640	GrowtopiaInstaller.exe
Token: SeDebugPrivilege	1172	Growtopia.exe
Token: SeDebugPrivilege	1172	Growtopia.exe
Token: SeDebugPrivilege	1172	Growtopia.exe
Token: SeDebugPrivilege	1172	Growtopia.exe
Token: SeDebugPrivilege	1172	Growtopia.exe
Token: 33	5748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5748	AUDIODG.EXE
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	2444	uninstall.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	3784	GrowGuy Proxy V4.25.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	632	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1104	iexplore.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
1104	iexplore.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
3484	WinRAR.exe
3484	WinRAR.exe
3484	WinRAR.exe
3484	WinRAR.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
1172	Growtopia.exe
632	firefox.exe
632	firefox.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe
1396	Growtopia.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
3368	IEXPLORE.EXE
3368	IEXPLORE.EXE
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
3368	IEXPLORE.EXE
3368	IEXPLORE.EXE
3368	IEXPLORE.EXE
3368	IEXPLORE.EXE
632	firefox.exe
632	firefox.exe
632	firefox.exe
1172	Growtopia.exe
5896	OpenWith.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
2544	OpenWith.exe
2544	OpenWith.exe
2544	OpenWith.exe
2544	OpenWith.exe
2544	OpenWith.exe
2544	OpenWith.exe
2544	OpenWith.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
5576	winrar-x64-622.exe
5576	winrar-x64-622.exe
5576	winrar-x64-622.exe
2444	uninstall.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
2836	winrar-x64-622.exe
2836	winrar-x64-622.exe
2836	winrar-x64-622.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
3484	WinRAR.exe
3484	WinRAR.exe
1396	Growtopia.exe
5168	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3368	1104	iexplore.exe	85
PID 1104 wrote to memory of 3368	1104	iexplore.exe	85
PID 1104 wrote to memory of 3368	1104	iexplore.exe	85
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 3680 wrote to memory of 632	3680	firefox.exe	88
PID 632 wrote to memory of 1588	632	firefox.exe	89
PID 632 wrote to memory of 1588	632	firefox.exe	89
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90
PID 632 wrote to memory of 4416	632	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\csn_hackv2.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3368
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\csn_hackv2.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\csn_hackv2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:5268
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3704 -s 1540
    3⤵
    - Program crash
    PID:4232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.0.896063738\468528342" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79635871-d8bc-49cc-8ccd-2758301eb8b5} 632 "\\.\pipe\gecko-crash-server-pipe.632" 1940 1783a7ec858 gpu
    3⤵
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.1.272030744\2014904999" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eb48d06-6743-4b78-8243-31655cddc6bf} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2332 1782d872b58 socket
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.2.707283565\1407146350" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {693322e1-05d5-491d-8b2d-50b2aa89ef89} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2988 1783e3fd558 tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.3.974352983\751944833" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {139ef711-eefc-4316-862a-ecee3fa7d85c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 3600 1783e9df258 tab
    3⤵
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.4.379971252\799210846" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58e9c5ef-be08-4be4-9177-74b858a7844d} 632 "\\.\pipe\gecko-crash-server-pipe.632" 4124 1783f67a858 tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.5.455183541\1862530992" -childID 4 -isForBrowser -prefsHandle 4732 -prefMapHandle 4680 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c3466e5-c70e-4bb8-9249-b980e1a9dbe0} 632 "\\.\pipe\gecko-crash-server-pipe.632" 4748 178406a1658 tab
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.6.1232819689\820624067" -childID 5 -isForBrowser -prefsHandle 5224 -prefMapHandle 5220 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9084b71-c08e-46ec-bc57-9cd666da32d5} 632 "\\.\pipe\gecko-crash-server-pipe.632" 1632 17840c1ee58 tab
    3⤵
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.7.636436797\366968540" -childID 6 -isForBrowser -prefsHandle 4892 -prefMapHandle 5244 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {380788fe-26fb-472b-9aaa-addf262e63d9} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2804 1783dc48958 tab
    3⤵
    PID:1768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.8.147804254\789119330" -childID 7 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fdf2738-0773-493b-9d45-e615e3ae2a52} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5684 17840620b58 tab
    3⤵
    PID:3668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.9.503894703\1794875626" -childID 8 -isForBrowser -prefsHandle 5580 -prefMapHandle 5728 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42148871-685c-4a95-bd97-8c1c4f262dd9} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6016 1783d3dd358 tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.10.621666924\1396268855" -parentBuildID 20221007134813 -prefsHandle 6208 -prefMapHandle 6016 -prefsLen 26849 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ed45fce-242d-4ece-a09e-8c1b4d07bcd8} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6216 17843bb2058 rdd
    3⤵
    PID:5152
- - C:\Users\Admin\Downloads\GrowtopiaInstaller.exe
    "C:\Users\Admin\Downloads\GrowtopiaInstaller.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
  - - C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
      C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
      4⤵
      Executes dropped EXE
      PID:5232
    - - C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe
        
        "C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe" -burn.unelevated BurnPipe.{936FF666-5492-471E-92FD-63557FD0F3A2} {EBE14EAE-F8F7-4774-8729-83A8402AE915} 5232
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2828
  - - C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
      "C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1172 -s 480
        5⤵
        Program crash
        
        PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.11.1680652215\1878576168" -childID 9 -isForBrowser -prefsHandle 1428 -prefMapHandle 6592 -prefsLen 29301 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b48abb49-7494-4c04-af12-31bb117a3530} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6396 17843ac4158 tab
    3⤵
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.12.864055573\756283532" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 7088 -prefMapHandle 7096 -prefsLen 29301 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1bfda03-2070-4245-a3cb-2cb29e26baff} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6592 1783fa75c58 utility
    3⤵
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.13.802325613\1215604896" -childID 10 -isForBrowser -prefsHandle 6852 -prefMapHandle 3416 -prefsLen 29301 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac2b2e0b-d198-4dfb-a38d-7ddc9c3f0d5f} 632 "\\.\pipe\gecko-crash-server-pipe.632" 4348 1783d2ebb58 tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.14.609090650\788222966" -childID 11 -isForBrowser -prefsHandle 7072 -prefMapHandle 7656 -prefsLen 29301 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17b5327c-3880-452d-8882-96326d067700} 632 "\\.\pipe\gecko-crash-server-pipe.632" 7672 1783dd7fd58 tab
    3⤵
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.15.987306833\1637646466" -childID 12 -isForBrowser -prefsHandle 7524 -prefMapHandle 5688 -prefsLen 29301 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74fe060e-56ef-4df3-90c6-686b3052b91c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6852 1783aa63958 tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.17.1043621144\876161407" -childID 14 -isForBrowser -prefsHandle 6944 -prefMapHandle 6924 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61386b38-cb41-4a1e-90cc-c5b5a2282ae1} 632 "\\.\pipe\gecko-crash-server-pipe.632" 11692 178450bcb58 tab
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.16.1141682733\1652105134" -childID 13 -isForBrowser -prefsHandle 11648 -prefMapHandle 7992 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1ea3e89-fea9-4515-b74a-6b6301b18005} 632 "\\.\pipe\gecko-crash-server-pipe.632" 11652 178450be358 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.19.847798156\498320308" -childID 16 -isForBrowser -prefsHandle 11444 -prefMapHandle 11428 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f026b68-0eeb-4020-a9ad-c1da87773375} 632 "\\.\pipe\gecko-crash-server-pipe.632" 7140 17846149958 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.18.531650610\1567765486" -childID 15 -isForBrowser -prefsHandle 11624 -prefMapHandle 2996 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f47db17-37a3-4f16-93a4-9a3edfb0aa35} 632 "\\.\pipe\gecko-crash-server-pipe.632" 11424 17846148d58 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.20.202804885\567732098" -childID 17 -isForBrowser -prefsHandle 7552 -prefMapHandle 5804 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {036f6aee-1806-40e1-810f-035e1f8c517c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6552 1784616aa58 tab
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.21.420858499\1252137912" -childID 18 -isForBrowser -prefsHandle 11056 -prefMapHandle 8964 -prefsLen 29845 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb3072e4-7cf0-4234-a3a1-e599386c3c57} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6980 17847b1b358 tab
    3⤵
    PID:5636
- - C:\Users\Admin\Downloads\winrar-x64-622.exe
    "C:\Users\Admin\Downloads\winrar-x64-622.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:5576
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Registers COM server for autorun
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2444
- - C:\Users\Admin\Downloads\winrar-x64-622.exe
    "C:\Users\Admin\Downloads\winrar-x64-622.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.22.434857822\48042671" -childID 19 -isForBrowser -prefsHandle 11684 -prefMapHandle 10748 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c68b9e3c-6d2b-4705-aa35-86fd6a2fbf80} 632 "\\.\pipe\gecko-crash-server-pipe.632" 11504 1784614ae58 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.23.828030446\1295860165" -childID 20 -isForBrowser -prefsHandle 1348 -prefMapHandle 6176 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebd2f805-f8a2-4c2c-a0ab-89f4aad62890} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9040 17843367d58 tab
    3⤵
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.24.96555052\707072415" -childID 21 -isForBrowser -prefsHandle 10680 -prefMapHandle 8936 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {814f283f-3666-4e00-918f-9cef44fbcdfc} 632 "\\.\pipe\gecko-crash-server-pipe.632" 8928 1784880fc58 tab
    3⤵
    PID:5884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.27.1107976459\725516309" -childID 24 -isForBrowser -prefsHandle 10208 -prefMapHandle 10216 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {886dbda2-03eb-45bc-a69a-7ae398e0e574} 632 "\\.\pipe\gecko-crash-server-pipe.632" 10080 1784870f658 tab
    3⤵
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.28.702879781\1479777206" -childID 25 -isForBrowser -prefsHandle 9760 -prefMapHandle 9764 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9993a8e-95d1-414e-9934-b09aa126315c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9752 1784906b258 tab
    3⤵
    PID:6136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.29.922991760\1439050148" -childID 26 -isForBrowser -prefsHandle 9808 -prefMapHandle 9868 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {380c7143-e95c-4e5a-b83e-d89c3021849b} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9820 17848535a58 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.26.376271314\871715403" -childID 23 -isForBrowser -prefsHandle 10444 -prefMapHandle 10392 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42d6354b-0499-4389-8d1d-554facde2595} 632 "\\.\pipe\gecko-crash-server-pipe.632" 8140 17848bdf358 tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.25.521733526\1014865704" -childID 22 -isForBrowser -prefsHandle 8916 -prefMapHandle 8920 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2732a789-46f5-4421-bc94-ab08da53774e} 632 "\\.\pipe\gecko-crash-server-pipe.632" 10656 178489c8e58 tab
    3⤵
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.32.1952062535\1596541423" -childID 29 -isForBrowser -prefsHandle 9580 -prefMapHandle 9584 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e0f1e3f-b76c-4af1-bf6c-ef55a354ec28} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9380 17849903258 tab
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.31.1631559282\1280011303" -childID 28 -isForBrowser -prefsHandle 9808 -prefMapHandle 10044 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d06b3ec2-1c09-438a-9d6d-49d1376a3a1c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9572 17849574558 tab
    3⤵
    PID:4940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.30.512695896\33647337" -childID 27 -isForBrowser -prefsHandle 9356 -prefMapHandle 9348 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa367eae-f0d1-4c8b-9474-3e732a9ab64b} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9364 17849396f58 tab
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.33.2079835571\175939745" -childID 30 -isForBrowser -prefsHandle 8628 -prefMapHandle 10308 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf71240c-2282-4425-8090-1ee1ca9a2e33} 632 "\\.\pipe\gecko-crash-server-pipe.632" 8616 17849bccb58 tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.34.1140800627\1443667360" -childID 31 -isForBrowser -prefsHandle 10692 -prefMapHandle 8908 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef9e8b6d-1ced-46b6-8b1f-f95e98b595a2} 632 "\\.\pipe\gecko-crash-server-pipe.632" 8780 17848bfa058 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.35.309129850\436040781" -childID 32 -isForBrowser -prefsHandle 7560 -prefMapHandle 6768 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {548ac19d-e9e5-40d3-b613-22c1258c7cec} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2964 17847829258 tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.36.1153398825\1021269255" -childID 33 -isForBrowser -prefsHandle 8816 -prefMapHandle 8812 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c21a21a-41ca-4fd8-997e-3d4dfb402f15} 632 "\\.\pipe\gecko-crash-server-pipe.632" 8676 17849b4a458 tab
    3⤵
    PID:7036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.37.810297629\1879908497" -childID 34 -isForBrowser -prefsHandle 8252 -prefMapHandle 8248 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3caed1e-2022-4607-b66f-3f440539d521} 632 "\\.\pipe\gecko-crash-server-pipe.632" 9172 178515e9158 tab
    3⤵
    - Executes dropped EXE
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.38.1427244193\23319359" -childID 35 -isForBrowser -prefsHandle 4348 -prefMapHandle 3416 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a860e1a-f856-4f3d-a694-476eb7c12a54} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5720 178515eb258 tab
    3⤵
    PID:7108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.39.1252384061\1637995178" -childID 36 -isForBrowser -prefsHandle 9348 -prefMapHandle 2700 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aaccf30e-5d78-4940-92c3-161fc833ccd9} 632 "\\.\pipe\gecko-crash-server-pipe.632" 7412 17847815658 tab
    3⤵
    PID:7936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.40.1019788025\1143905671" -childID 37 -isForBrowser -prefsHandle 11748 -prefMapHandle 11744 -prefsLen 29919 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49339e6b-ba94-4fd9-9f5f-fa7f7b022fc6} 632 "\\.\pipe\gecko-crash-server-pipe.632" 11760 17851851558 tab
    3⤵
    PID:8076
- - C:\Program Files\Mozilla Firefox\crashreporter.exe
    "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\minidumps\54959c2a-a59b-4d55-bfa1-b7d6e649a09d.dmp"
    3⤵
    PID:8116
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 8116 -s 456
      4⤵
      Program crash
      PID:7292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 3704 -ip 3704
1⤵
PID:5324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1172 -ip 1172
1⤵
PID:4908

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:5752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:6016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3984

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\GrowGuy_Proxy_V4.25.rar"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3484
- C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.17444\All Files\GrowGuy Proxy V4.25.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.17444\All Files\GrowGuy Proxy V4.25.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    - Executes dropped EXE
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\flptiwm5.l4k\GrowGUY.exe
    "C:\Users\Admin\AppData\Local\Temp\flptiwm5.l4k\GrowGUY.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Color a
      4⤵
      PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:5844
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    - Executes dropped EXE
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    - Executes dropped EXE
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    - Executes dropped EXE
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    - Executes dropped EXE
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:6240
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:6260
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7720
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:5160
- C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.40795\All Files\GrowGuy Proxy V4.25.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.40795\All Files\GrowGuy Proxy V4.25.exe"
  2⤵
  PID:6288
- - C:\Users\Admin\AppData\Local\Temp\lxrbdkzj.qpv\GrowGUY.exe
    "C:\Users\Admin\AppData\Local\Temp\lxrbdkzj.qpv\GrowGUY.exe"
    3⤵
    PID:6216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Color a
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:6204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:6580
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7712
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7808
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:4528
- C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\GrowGuy Proxy V4.25.exe
  "C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\GrowGuy Proxy V4.25.exe"
  2⤵
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:5612
- - C:\Users\Admin\AppData\Local\Temp\norxx4kc.hzi\GrowGUY.exe
    "C:\Users\Admin\AppData\Local\Temp\norxx4kc.hzi\GrowGUY.exe"
    3⤵
    PID:1084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Color a
      4⤵
      PID:1516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path="C:\Users\Admin\AppData\Local\Growtopia\save.dat"
    3⤵
    PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:3712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:5488

C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
"C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1396 -s 484
  2⤵
  - Program crash
  PID:2432

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1396 -ip 1396
1⤵
PID:1664

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
PID:5600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:7408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 8116 -ip 8116
1⤵
PID:7236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 332 -ip 332
1⤵
PID:7024

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 332 -s 3796
1⤵
- Program crash
PID:7300

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5116

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3d199f800aad4eae9489c9c116ced52d /t 5380 /p 1396
1⤵
PID:7476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:7540

C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe
"C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe"
1⤵
PID:1608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1608 -s 456
  2⤵
  - Program crash
  PID:7648

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 1608 -ip 1608
1⤵
PID:7616

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
eaf2b4a8cb83c01a0cc1467f9c0ce105

SHA1
62c90c740292afe990f91e3f4dd2c643141a8f17

SHA256
721cd25c9f544b3f19a5a1c32f2d5d776eac9f3639673a944365d84717becbb0

SHA512
7024515f30290c52f65005f32513206b634d4b0730c0faed60828d97e12c74660e264603511a61f34e7d569446bfca1b25482fdc947aeb02d328c68f01b39ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
035e6621d50ec971e811ec3fd6b3d78e

SHA1
d583b8d414e428de7a9eb234dda4bd1574fd4ef8

SHA256
f92efb8ab1db24647d4509f2cb53073b7d4cede2cfe51c920d164a1099a908e0

SHA512
411e60485ab193b1335177472ffff814933bd58cf1da4c92c7154c15ad297f3ebf1bd1cd11e25692ebe5535871e655421c7a3e268c9b1f37240f5131d2248cca

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe

Filesize
43.2MB

MD5
818f4d537e9de4d86964a9f65243de94

SHA1
97f19b87b17791f7b0d257deeb7e0b3f63cbb081

SHA256
029721fe39756f04587809a8bb8c6754f33df6c2b6b574a470c4de2180c9a600

SHA512
2aeff5316518b172482e39908e2b1fdc6db12d5d62fdcd08a1431c0ac891d38c46b02a2bf1345974913a5447185ab2a7507ce8d3e8bbc19c8b5d7be505621491

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe

Filesize
43.2MB

MD5
818f4d537e9de4d86964a9f65243de94

SHA1
97f19b87b17791f7b0d257deeb7e0b3f63cbb081

SHA256
029721fe39756f04587809a8bb8c6754f33df6c2b6b574a470c4de2180c9a600

SHA512
2aeff5316518b172482e39908e2b1fdc6db12d5d62fdcd08a1431c0ac891d38c46b02a2bf1345974913a5447185ab2a7507ce8d3e8bbc19c8b5d7be505621491

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\Growtopia.exe

Filesize
43.2MB

MD5
818f4d537e9de4d86964a9f65243de94

SHA1
97f19b87b17791f7b0d257deeb7e0b3f63cbb081

SHA256
029721fe39756f04587809a8bb8c6754f33df6c2b6b574a470c4de2180c9a600

SHA512
2aeff5316518b172482e39908e2b1fdc6db12d5d62fdcd08a1431c0ac891d38c46b02a2bf1345974913a5447185ab2a7507ce8d3e8bbc19c8b5d7be505621491

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\SecureEngineSDK64.dll

Filesize
28KB

MD5
023ca3f56ce9d9aff9e4839301e82c82

SHA1
fec3bca7c4f43c9c44ffcfca1f41b5a480cba78b

SHA256
9387fedbd201f2886a28f32d1ec155a69ac86ea78e331381f6db521f8b4b5a11

SHA512
18bea9d3fde048dbd7ed0f039d44c36ccb112334b4188632772c35de06042e6d4077e1dc68ce6ac4f3a8fc4d1134940d24216a9451c79a813cd0ac33c56d354b

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\SecureEngineSDK64.dll

Filesize
28KB

MD5
023ca3f56ce9d9aff9e4839301e82c82

SHA1
fec3bca7c4f43c9c44ffcfca1f41b5a480cba78b

SHA256
9387fedbd201f2886a28f32d1ec155a69ac86ea78e331381f6db521f8b4b5a11

SHA512
18bea9d3fde048dbd7ed0f039d44c36ccb112334b4188632772c35de06042e6d4077e1dc68ce6ac4f3a8fc4d1134940d24216a9451c79a813cd0ac33c56d354b

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\audio\click.wav

Filesize
18KB

MD5
477c1e4d4ba5c340c13a77fd52a03cd9

SHA1
fc05d5b94d33a9f472133c7c47f52aabd3bc1edb

SHA256
e46278f894d538b366acc40925db83b8ac4daea030e98276cba5ab179ffe563f

SHA512
3322db0bd62a56f7c70799553390f6d38e263a8222ff709316da11c4cc3523dd940f8d6789d7d870d37c9e2954c0b7e67ba9dcbaea689c108183aebd8a49f825

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\audio\dialog_close.wav

Filesize
74KB

MD5
ecba2775337d1b8decfb99a02b7959f3

SHA1
49255870ecafaafcdaae37cbc884124f2feded19

SHA256
9e3c2a988db4d0d55cf77e8fd732a72296291146096fb702001266c2baa6cac8

SHA512
67286388c3a2288a9bea3fe32bc04178eccda82e26709bb5dc3025678086e0edc19ea145ddff69e647e49f082b6e7b4dbb391ed6777a8bc40db01eee9fef5d8c

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\audio\dialog_open.wav

Filesize
81KB

MD5
fe4f751da37697ed5e4ce1de6982c22d

SHA1
65d317693eb30cb9c7b58f67f300084509e5e334

SHA256
ded246c0f02639e9edfdb2066fb3d221a924f869be4ad0a9b491e83da928c8c3

SHA512
c8f92e92e8d7b5827e4fa050dab875bf84d3bcbea27c1dab8cca263aaf7a92c2d1b5c76b3dcf3475c30af4abc31abb28182a72f4f6ed803584a727e0e21c061e

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\audio\ogg\theme.ogg

Filesize
1.1MB

MD5
4c89d42656669904b3ced470ddf7400a

SHA1
3498e8337cd4a1523f335afbf20823711d96833a

SHA256
2f0492ef34b4e5f8de1022ae9cc429eee1e260e0aac5ab260e55402a15ff7db5

SHA512
9cc2c31ea944198db44afb5996da9946df892c19fc5687e438c3621773969c8de5db8cb3d3c86c53f4cebb0ced7e3071b2c57759eb89b962c93993c52564acb5

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\audio\tile_created.wav

Filesize
8KB

MD5
0b90c8a37d49c71ab7138f9bd3717feb

SHA1
dfa178fff3fe10651802fcbc6956203ad46037ce

SHA256
0b6d5b3b0a71d75afe4e7cd08798c0aa00de97a577fae7686b9e09e5ac17fd7c

SHA512
5318272b0d0910fa1ced5bc842c4f6065ae157e8aa93ca6789dfeed199cbb93c6fb682fabda7bb02d979dff9ba3836305105227b47c056cc98913820eaa5b9b2

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\particles10.rttex

Filesize
256KB

MD5
c92f5f87489456f63e808d556d17dda6

SHA1
2aa7b7acba2071d2b0b3b1bba15fe2627b24fd2a

SHA256
95491650f4d537e74ccb7c729f0e1da0bdc116ba51713f668f93524972b890c0

SHA512
e2412f3e893c85758eb9fb1eeb943b6100e05a593979459875d40749a8b9f12075d4ecfa7dee35e07ae882cc96850d3c9db74e5085e781c8a8bdcb4f56ae0cc4

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\particles_large10.rttex

Filesize
61KB

MD5
c7afb6a6c2efa9582e87ad178ab5477e

SHA1
a7fa6a8292bdd079de5d5335c1f30d07c8abbf6e

SHA256
a74595f09f0e906ab03ea3e818e0927d8e5e152788aaee11835eb5091a23ace6

SHA512
f1784ced55dd7055e36e20dd14184793674752a114df55fb5e1c9a88e28448b04411006341f51a7c329c76872d44fae4b415f52ca85c65d2facb8d8cc9ed3a8b

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\player_cosmetics3.rttex

Filesize
22KB

MD5
af26e04eb323b95d3cc3c787a000fad9

SHA1
2366105067b10469ac6b1a2422158633c463c71e

SHA256
9e0153a8e3b5618ca78810f52e4289f1420c6494f387b071e7c7a4e9d5f6db3b

SHA512
6c4ba7a30d7a474a038e1039827bf80c3652df2f484baff066e4be6a6eb68c7028d9819fa2dac19d15187e965eb7c5e063ade110762c3057e0c65d4d60f065d3

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\player_feet16.rttex

Filesize
43KB

MD5
cdde8ffca38a1fc846d5b6f3a2472910

SHA1
0c30871e8599df3563b16e1c0358272ac5211fee

SHA256
5197c09d37e2ddc21831ba75f9dc015c02ef820aef0f40dae0bc81ac566e89c2

SHA512
4f57a23eac88771e1803040d055d9b5e30e187b631dfefe2932c541be3cdde47dbbb0fe89487a0c4f7eb0dcfd18fc0c6e414a45ae33c924fb27dbe898670ba91

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\player_longhanditem3.rttex

Filesize
35KB

MD5
4056c076eb0872770f459f29bf1ca2a8

SHA1
59a82fcacb50e3e833b0990f1941084f1a1102bf

SHA256
6973f9db9baa397d3f8201eaab3040947b27f8dc2110519c6904383726bbb4ee

SHA512
1c70ff6f20cb023a20cfb0394483afd69c192f98cbccdf2f8dabe874c4fa3af6c9bbd28d49b6a8af64fd5d43918f8d5887a6dc120ac76594028295f31aac6ff9

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\game\player_pet.rttex

Filesize
43KB

MD5
b0fdb92f3ff953c18b197be85bfaba71

SHA1
9b402134020a29bd62a66dc6f0a25b8529ad2930

SHA256
3b55712d2570f78a0a090a005b2f000ca18b43fa826a5ae35ed1cdec5e9e4b80

SHA512
3b9b0b468f1fcf00a729206bee7095680e8d9557eb4f970d6bfd30c8a2169629fc4f772fdb713fa17927cfd3b1833fea90276c0360d88c9127e0ee6f6c72fcac

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\cache\interface\large\event_button2.rttex

Filesize
195KB

MD5
4ed290184800d35b0eaea4c96edbeaac

SHA1
993d75883e6f0b37ec3b5126ff7b5e593e2e20b7

SHA256
05701f7d4c87138a722862fe260614fbabc52213376e7e1051b0d182f42dd0f3

SHA512
a1a2d37e38bc0f63b96650bdc6e5ee5b42075b1af78a045c64de936e047c363f1fd973e0302233d0fc8e8bce86019be0b5dda0abbc0666bc9a1b52e16e494527

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\fmod64.dll

Filesize
1.7MB

MD5
29b36598d48261aec75b1eee69dab669

SHA1
ae3143a5603badeed76a36f5f2429999ce4e7015

SHA256
e5fa4e47ae9ac18d7d2927651130a1630bfff97546f01646792384b9f3552f79

SHA512
6f316cfd68b3b9294e5ae929eeac1fee317ca17c64f3dda9e6e8504a16a8022ad19ca0169b4088fe91697cc48c33d8fb9c25558c5a364602e1511ed440ada5c0

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\fmod64.dll

Filesize
1.7MB

MD5
29b36598d48261aec75b1eee69dab669

SHA1
ae3143a5603badeed76a36f5f2429999ce4e7015

SHA256
e5fa4e47ae9ac18d7d2927651130a1630bfff97546f01646792384b9f3552f79

SHA512
6f316cfd68b3b9294e5ae929eeac1fee317ca17c64f3dda9e6e8504a16a8022ad19ca0169b4088fe91697cc48c33d8fb9c25558c5a364602e1511ed440ada5c0

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\cloud.rttex

Filesize
5KB

MD5
7022f170a353e67d64893b617302307e

SHA1
0af46a0b3331fe7080966323c27908e462ecf1ed

SHA256
f369d04d3b5d43c8bdacaa49cddca19132f64ad2a806d520c8191927831c9123

SHA512
ec279cdbea794023f28f03218c276e7a9d6a3628608b1a11c6fffd6de351a37338af63b4e5ebe3213d6f5549d8719513602fdbc93ced7101e551f610bd55f4bd

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\gui_box.rttex

Filesize
529B

MD5
d70d128e0d20aedbe2a0cb488e77b0ca

SHA1
a3fa6f1214cb74ab711813cd92052f47ae3d87c1

SHA256
306710de94944683c093bcfeb3ccc588230e9c950fc6d26cb2ebcd54930a2dd2

SHA512
bb405c6b1ae95d8bb7ebc04cfa1843bbe1e4dcc417dcf9befe43c569676684a26cefd7e463eced7791d5ed616d63419ecbb7e9fb1b04461253fadcb030839a8d

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\gui_box_upwhite.rttex

Filesize
363B

MD5
4af9c77ce2ddb7ea19a3864e29277624

SHA1
5b14b1d36163d6ff07596e1d6ef84bf04a6846cc

SHA256
476cc50d752f1c171a3e460dd874e16681a43faf003b58f7f3d19c4e7059e948

SHA512
316c9a315b21c4e65005807094902bf73e6510fa3143abc59c2879c3c269664eca628a83bd8ab95a7108808ad2e7849a4b439ff6a0584d6aa5842ad1384de1fc

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\gui_box_white.rttex

Filesize
500B

MD5
f4715cfff579b5d89d412e788e29b126

SHA1
d4937ad1d75b80bd56b1aca5c6440f95abe2a59c

SHA256
b241e30e6cac259326c4e5a450c7f7364380a0a813cb7f0729fdaddb35210a5a

SHA512
9f85ca23d316dd0155ad876f2f74a013a61a239588fe43542f8770b758efe47b0910660f365f386f957fe3b68604c92d5cd6111b493227afff3baeafe83e4173

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\gui_itembox.rttex

Filesize
4KB

MD5
1cf9565bc0846f3af58fc255f6200f2a

SHA1
ec34ad178546ff476f43019bbb0d20fd238442d9

SHA256
c08c9333fc74cdb5ded5768796f7a5045defa37a7b30b185a5fe934459e70a8b

SHA512
fed9e48f1b759264d06a6bdaeff93f03c8a8439178d00c8f61ee033e8bd8ff2c4df4b0a6d4fc5a81fa000fef493fe068da5c4c12b312e247bf60088b34854f96

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\hills1.rttex

Filesize
11KB

MD5
b679e2d7f84f309806256e68e83964d1

SHA1
9be8657b2634457e9e4fe20e1ef4c96293f803ee

SHA256
410c970ae0fd75227521e96c61f6e6e1a1d8e20e4ee0e0690658c1e563ddde0e

SHA512
2e72f18682d491531fc31d295bd7c4ecba12710a30bdaeb0c532c6b125328a450f09f2b10a0bfb8090bae6bfcaf3080a2b5c258c37c8227b564b1a70d5b5a0dc

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\hills2.rttex

Filesize
16KB

MD5
f98e85342f4ba4e029825343d2edc82a

SHA1
addc9a7c89d5e2e8941e1ff285977c11e427bf95

SHA256
ff6cf5f5c793164477194bce42a553cd1eb9692b2159787bd52f92355bc5c400

SHA512
e4ac471c62cc1af92ea9bd18a3f900a6528bbc1338c8ba32bb2b1adf48329c4fa3caf926dd702fceb31b3d30ef6f498e4418272fc1b4ddb379e0dc87f73b9eea

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\hills3.rttex

Filesize
19KB

MD5
1f698b5c5fdcc605929421328202e196

SHA1
7271f8ea43582522f42cdc67688e099c1b438ff2

SHA256
694863f01093c74f89ebc77812dcc5a9ebcc07574b658ac783fbbf59ad124caa

SHA512
bee8e7df9a31c0099d6ca0bd104dae60ffe422f6b62c1f9467787aea435821091bd740e91f4d3ddb581c5bc40b51f2fc3489fd27c574e0ec253a2544cbdd440d

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\inv_select.rttex

Filesize
484B

MD5
df2a13dc1d74a7c51c1ae245a05ed460

SHA1
0e439131ca1249110009aafe7c30d45ac54aa39a

SHA256
ed494d280f5e20fc6f6818a82f5f623638f706f2f6af6457cfc74501e5c7bd74

SHA512
0a611126222780bb2f8a81fc432041609da11d8a192d112eda91520888825ff2ed8d31593064d4fcd6ca1904adaa0453ccd43d821f5dbdeb049d21047076bf82

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\sun.rttex

Filesize
6KB

MD5
09dae892f07dc20c3192a03ca8cada1e

SHA1
28f1e09a28eae0586cb82915753814b85eba09b8

SHA256
43bff2cf3ec876b887b0c42a35d64f4b1434fc95d308241cfafa16dc825d41b1

SHA512
72d7ac5c37ffc192b2644ba857abf87d314738fd4e29849a8b26af5d33252e09e90f1e52bdce68d5d9c32a9aa14db9e00b66e528eed114596e950ef57ade5639

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\game\tiles_page1.rttex

Filesize
270KB

MD5
65cba192b36feb0689877fdbfab39389

SHA1
9d6c07f22e1acf067e982deca9b2de35b7430788

SHA256
03840b948d40651c2357bc35512fe7d9c470a4f73635de0825563b9c3341dc84

SHA512
fee803c516e7d8a0dd55b71dade75f16a4fd47be58857fa03da65dbefa1451d4e94c5b01341901f221e21a6193b2157cd9f87d81401dbddf63184949b68da94e

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\checkbox.rttex

Filesize
1KB

MD5
a59f7b73db9dad0f0a279299705f4157

SHA1
8abed5eb872d131bea257dd145710a3994aca9d6

SHA256
f1e181ebc2470974f961f0479d322bbb83f0a0fde735d31219164beb76c6859e

SHA512
7c9587756513d7378af3c196f5b781929c6452fb9544e46e77f438da43f82f852efa3dea48d9ac74c2d70417d0e17d464a9d1ce6bc7e174070336da7b7aa4a0f

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\currencies.json

Filesize
1KB

MD5
f0bd1fc33690fdab5368c6cf128ce7ec

SHA1
c7d72977a9189687625c1f8b3bce4d6f6329426b

SHA256
6bb20302f6215d609e8c9ef970d02218861dea9662f942be5cabec1cba3d6052

SHA512
faa209662895eca79e2c0be92ce6c6fdae8bd2dff69254355e95a10de2d62c998b5ceccc9a87b5f29e613a56dd8e6726ce1a60543ece412a9dab316d132ca651

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\font_century_gothic_bigx2.rtfont

Filesize
108KB

MD5
c8a90412bbdaa39a814d27a10b7670ff

SHA1
fb5784b59adb4831bb5c693a6c2834d5ca94c01c

SHA256
bb51befa9db4d2a891804f4e750c89025db89a2ae033c9ec56aa591ae94978e5

SHA512
a1bafaf82bc3a05738a6f51f87b836cfe556f191cf5363e31739ff06c32bbe4db310a9856884a3de3af28114ef620ed6dd542f0a328688bcb5fa6ed48662ec6e

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\font_century_gothicx2.rtfont

Filesize
35KB

MD5
b89c4ccbd3180f627cd3e2ae2336733f

SHA1
d9481a501fca4ff2e9b732d1d24e9bffc9e9bc06

SHA256
be0bad0e4b3688573c2fd97a47869d624ef4651f7042ce2362752bc95295561e

SHA512
24e0f62cdb9ddbd800d72063745314946562a439257554d4e7c96b88dce51698deb145e05cfc5959090700bd8a96bc81a8abc457c3ce26cfaf5aabd5b15ffe50

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\handle_big.rttex

Filesize
798B

MD5
77f818cc43c94e92c318ae8ba75226ec

SHA1
bb6ed3d0bfdbeb66666f557207d727e983e87984

SHA256
4299f19cceb8ed82fcfafe86fc31ab79038f91ca9028b4e86242c294e864be85

SHA512
3ccd27477e519d1a48fae8c5d7ebd0b73d67fa49f5a7c326f59eaa6b8585d3f44c2f1f160633cfa14573993a63c41306cd7b2d1f0f745576becc8a5f21b52905

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\large\game_title.rttex

Filesize
139KB

MD5
ace9c653e2ae8ef4d5cb6da6fa207049

SHA1
7296d34d8985a60fa03c7b9a8db7e484a5f73af2

SHA256
85996c8e9d490ef6656e2a31643d691ef53de42ccc89e00068413fb700403ec8

SHA512
c98db7cbe7bec53370326ac172b5dcf65a1f3597f4b3285b7a466da039493add8c0f41630489c1818e77b99e3c65341b1191b901ade32af8a7c86f4702a8b58a

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\large\generic_menu.rttex

Filesize
36KB

MD5
fdb01cc88836cd7e39cea68f55dd74c3

SHA1
99923a57d3c16dfebbd7672c5e106f9630e66720

SHA256
3ec5f42da3db318dd04d6746119a56fb43f1f9959333254035c0e25e904f1271

SHA512
63b2f1847034fe384ac07a30d14b13b6d522905837f8b43dcbc1d10525308c44326a8056425aeb289e2e51505a51d80414a93d9cec0e22cf88f8649de5e8d589

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\large\main_menu_bg.rttex

Filesize
8KB

MD5
8a699381434d8fa8dd71f25bfe331887

SHA1
14ade3cd6dcf8961b539fb4301b410d275aac483

SHA256
1e888b2a8519ab39b06f6dbcc60d0b0c13057e079cc32b5caf666130dc0c8871

SHA512
e9ab499a26c30f6e6f69e9fd8de23e1abc32434e8bc6b22d836f4aa1efaa900a4126e0412bc4cf7c9a082c2d2ab60dc7b6b5be8101e39b7773ee075f0bfefe81

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\large\store_buttons14.rttex

Filesize
67B

MD5
1896385b19daa70f512320ba52a1fdf6

SHA1
63f2954b2cd949e45d02c4f1d4c3f35063aec757

SHA256
71fa2aa665788dff80d37cc26db1f6845685d7542bcdac61779a95a51bf95309

SHA512
f23b50c201e0cf1ff42e4e543e6ae856573cec3e11fa6cec66a8ca661fe69f3cbb4728b3d0e4e2762cd9f2b98e44297d9969ba1a93224dedf8e8e044d37febc1

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\rules.txt

Filesize
2KB

MD5
7ff8253f1cc6c50252b8c54e96f64984

SHA1
099ad30aaaf2b0af33bd062cd185371e5c3da511

SHA256
c8947a4d32f5fee581b78de0aff2a471a7b48859b5da30d90691dbf48f41f617

SHA512
5c7ebfaa3096c757859e89dddaafef84a9d30b4b179f11cf7c8229a9691beba098e68b1085ff8f4eb217c4235f0ebccb838f54845b0f1496b81d1dbfc792cc80

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\scroll_bar_caps.rttex

Filesize
161B

MD5
8760d0574490808e17f8561d97a3e1d0

SHA1
8da3acb30a64f64791fbeb68e58f3e9b20fe9e58

SHA256
bad41f5865fef38c2bdf77d43495013e7c33ba6a23174f8588afd5690df499f9

SHA512
89e967c8c95cb9a897b183de4e100800421ba66241734892ea061731a57491a41dddabebeb81ae0bdac69b1259cc7fca8f9dcad7b15618b810646a58253e123f

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\slider_button.rttex

Filesize
1KB

MD5
d368d3d5593559f9c547508899e3f0b2

SHA1
26e8304bc03ea10d0010017c0e0fe967d6eecf51

SHA256
1b56a9617947004fe17ac977416c08f17833f65f8e98415597b63843c741d474

SHA512
be4613563376c4cdc16d891057867f54e851e02083d5bf7aff6cb566c9b33379c75aabf81fad3bd719c2744ec57d14099ea0b656a850da3cde94c6cb4b3c24be

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\interface\tutorial\tut_arrow.rttex

Filesize
4KB

MD5
eef93a8d0966bf14812a2af44b04ff9e

SHA1
e261ba24262ade23a31779f2cc3844a4b4de58d6

SHA256
844042f9e482a948cf73f51923a60147f7635f34d2c2890b28b5d71262e4c362

SHA512
8184746d9425437ff775a1c0096493d9af0281013755b35c6e5f9725ebf1231bde57b6903ecfd34adbae3e89baabac5627154b90ac5b5009057e5e5e61c246f2

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
965B

MD5
f0f8d9135f3268c8426be6a876da0075

SHA1
290c8c4da5421fab7f06c985eae6901d6e385959

SHA256
ea6a5a0faeabb5fa3bf850bb05746c75e77fe200a005df183a619bb34dda003b

SHA512
835d2a2b228704ac8d90f761f586e2722803532a0cbee3ec0431200754366eca224b8a6ebd52760cbbd7d985c86105b76cb8195cf0bb7da646cb8cac0a9d68fc

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
2c1156cfbd6eecba8b6d9019be1ca20e

SHA1
4738bf3d19b0b5bc220c200dfc8f050b83638b55

SHA256
aa6d1108ff4dc5dc06a1e51ff8512f5af45a08a61aed7f5163247a4e505eead6

SHA512
355a96828229c5ceaf25c02044e7b70dd2bcd50bcc294e770dd2e5c3600a35378b70ac4986e4b82f1aabcb3013450cb317e950e5b5d6b79cf78a2c82d4231b37

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
342ed0f8b4eef4297ba0fb45c445c8ac

SHA1
04d774ff53a149bc5bb8d03debe974e41d73b1d4

SHA256
0caf66d9dd49e7050a6eb082746606c14d3be160ff0e061ee8a20d1c12fb766e

SHA512
a2c5b859115e2052ddb90abea03dc4449844d5a39df869049603524fa286857de3d2c12433158387012b32d1b7a4c7547ea066e8ac64794e2fff15a677946b14

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
6db2dc38773d543b3e652445501e22b0

SHA1
fddaaf45efaba4ff118ee7f0c03cf1180750d6cb

SHA256
fb44ab7bedab8eebb4e58420aa1da4cebaa663e4ae0198dc577a8ecb80882b12

SHA512
1f9f071caec5b270ed7d1bc1a2b0ea9c37e8c25a8ddf528684f2b00caf348db61e06467dec2da26b0ef4d0f7169190c2275006cc915bcf0e30afcac31378c312

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
ebd8fc6d152bb1639da899f3ac5196f7

SHA1
abcbbad29b05c4d5f2a171f764dcc648c78f422d

SHA256
edeae93d3a7eb8507b741076f1e483ad90323a2ca0191e0232c6936581599c52

SHA512
898669557c9ce887b81dd8b910f05895e9122bd6de99adffbf9ad461b3a7de3e83330b4d53de770414da7513969fb40bd092c338faff2b0958e1d2f91413a78a

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
3KB

MD5
99b740d6633c473b4d6263f87f058c06

SHA1
8e1863bd4074c879cc1b32294dbf8c5459a4a479

SHA256
2584bd94a2b9c28c2b3462e9f94895e828932deab1a0a54c26bbdc087e1c1052

SHA512
6991c8595f922e63c18c30ec6a90cd3ce43065241bd60b6721165bf70fe87144441259d20a710a60749d7d578344c73b59efe13b26db51cbc17dc2230c0d5772

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
3KB

MD5
be5a77d4143f56e7882cf51568a44c06

SHA1
21897ab73aa26ee2c7aeffff5389d05ac0c1f4ed

SHA256
deab8f4168a0c0310367492344ab981edc7e5007db310df3c2faeb8bdecba64f

SHA512
5fe58d461bc635450e1c4f814941bf40d2c50603434800c0976adc860f448b7e8787a31ffe15e8f53908448b9cf9d91d80ef6c8b268593a28d2bdec8dd1db432

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
3KB

MD5
2d09d98c4a9acf648961074c348dedae

SHA1
0dd004869597e5b8f35905b51ef2e09a660d510a

SHA256
3eb27a96d722273265a383360039ebd9c38e9576b5da3d73ae8705cfae5b9294

SHA512
98e22160504112193e3155d9a7e832a08443c2e9f1d72494b67eee4f2a367cdbbaa2db20ec2ed523870b776e2282892254068a5e08e36a06914b8e5330cc29f3

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
4KB

MD5
f6b175def4b8f9dccc090b31adae3ee0

SHA1
0f0813eb70e41b65912099e67f345a5b6a47040d

SHA256
2a976779c50803106cadc8e76befedc16758cfd35c0bbb2dcf4a82b894b80d32

SHA512
970a485797548a29710839a1ca7c2ce5d0f1f236c57baf406583f36d4d3ccff59666ac00d3d6342bf00ee322b38593c829880c5c45d785294b4ddaae3730bbed

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
349B

MD5
c3a20a0c5f0ec28202a26ae164665c8a

SHA1
3c8b16ec859f01a5e9ac0e7dfa5e88fe69b5f301

SHA256
902a594a2e88cafa809ab220d3bdc8f99f85188e556d5e423ee3d0c7784b6f13

SHA512
7082cbba1528c7a871c1e3bb3f9a8b07982eedb2a79b9b015d80af4f4154db6192573ea7dc8d744f633c35466ce371587b2fdc159e8e0a1d2c458402741f721b

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
406B

MD5
5fcf49630570d01bdc87ef4cce435df8

SHA1
918d703a3721ef520deaf065921719bcb41e9489

SHA256
4b71b4b757045f5c3b17d5828623556722b09c7b408d8809b713982eec25f41c

SHA512
ca86dc7ccec6d95e08ab589e6634c0ec85607248ecf5d307a5ae2dac6f8f6e13398c271a79b4d8fe73481dd3ff5c60c6908686fd8975ed2888b6524f4d91e680

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
671B

MD5
3470ccd4c9600cd7fc3dc00ed1106706

SHA1
1b8399ca124ad825263f205139642b9ba30e8455

SHA256
bf210a7950711bd6c78079eace29927abfc9e0ae1847e1b09874ff2be9ab1003

SHA512
51ec59576883b91968187212c087997506f67748884bd845a2936277d1f65e41934b36a607efde5b39455c62ae4f9e7b2d4dacbd49f8ad26fd3b03351cc5d2af

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
936B

MD5
4474b0b1c336e39a961542bff21fff97

SHA1
9123a94da4aab6cfcf3b8507e87d27c6cff08abd

SHA256
4101a981c74250248a958ad0f1413823e493ec90cb0ee3686eff62b5b7457f36

SHA512
0bfd11684f6433330796d6e267cb949d4c720a5ebbe4ce703396a6e0f5029c15ea2da8b019d00fc532247bd9b95a0fcde344f434d0ad0348fc91ea85db5639e1

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
8e32a43d8b40a19c4013cebeacec7054

SHA1
5d2f30783e0ef57ea80a9594dc8d9d4e082e0f82

SHA256
66bda7c6540f5776c99a3f7c3054f4566039d8b6294864c6c7c9a341ef8ee378

SHA512
ecf242c057e1a8c806c6f6981c2c77bea2625e1addcf089b52d71e68ca681aa67abe76aea1388791ff034e3c12545df360f3923919a9dae576ab6d284c1a2eac

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
2373ee1bc2b717a8c602c027f34d45ee

SHA1
18fb5325843f4ddda69eb8c308a8e75a140d5696

SHA256
d84d7065b72ff83e23309647eb3ca97303a763fd61ce3bdb2065e1407862c1db

SHA512
35ba1c763722b168e5d955b1f6aea44a376e16719c000dc52700d5cac343532e6001869b8693f0c6c99c87e08c89c9e0876463690c50d7777ba7afbbaadb82f1

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
7d5adbbcc2a6437d108e989bbe4aeca4

SHA1
f5f2e182f448ab03a49f9bdb682b549af4dff508

SHA256
dc2976371b6ea71e048f38f346569c15fcafd2afc20a9e0733aaab03bbb78d79

SHA512
ab52373382d02e984a7553bde293b7b2821b14b0c5b16d247781abf0f4362afe3f859d8f97cbb6c94fd8d1b8e3daea8747c9c18ab284ac4706d3315c5367d5cc

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
d8be40228e538c82b44698c0f3ac61f4

SHA1
de46cddc3bb69dc22289b32c2251112aeacdbf19

SHA256
1501f1e7ecb6c5e406092c6be363a5b6edf2b9039621aebc6d40d9e96806324b

SHA512
c6d075c2fa7c15641948175d933896db6e2a3a6102285980a8a1d38aea12e1f1ec4361f52faef4cd7bc46b4e0d9fc63564bdeb3fb9b9fae55ab23741fbe79a16

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
22c26c6b240ef2acf57fcfd514536f0c

SHA1
7f6b70d0841968c287b7d5778db11a80a129efe1

SHA256
c6badd33f6ea4e6adf7fd74acda6604f5dd603d4a6560dd98fbdfd4c7fb2707c

SHA512
985731dbcb2ec0f5f3fa68386d1777d4a7ed5b3e3b96c2052e88722f7b6e49dc475b5732e43cac1a881774b374f3ce8cf76e8fbe9294437d66cdea2498f4bfa3

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
3KB

MD5
a5c6db1e6ce42842d0cefc16526f23b6

SHA1
a0bfbda2fa363ccedb1897a3dda9e5779748d408

SHA256
e75f4ab0241d62e1276996c1905b44c1c4c9c0da5664913ca359fce4feb24cc2

SHA512
f3b22898d8f4b21e134eb7d5abc2c17fbf79d290555b1d8eda8980646bf61b827a9d7bc4ba17a2bcf8de12c052e4b90153b2b0d8eca1d8f065d15fa6ee6c80bb

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
3KB

MD5
de65b4e36436e32f4de95b661745bb71

SHA1
9391ef105863189c6a87dfbdf697cf878176b859

SHA256
bc4a9947b839d4da0f09691c56265cca9e43357fe58acd28519744bbc825a026

SHA512
74faf2558d394d83d359571537e0ae5ab8624caade6218ec533a6d0fd8c73e1d8011922330185adbb67738194b9aa17a33cf2b69c126ee50524bbcd649a41696

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
4KB

MD5
cb2ea44a840e00db0e2a60e302585d88

SHA1
9f1fa94f6722922c9683045814e7b42a6dac45c6

SHA256
204b79d4d6495175af96321da2924f776836d2e51131d1882467349ee60dccee

SHA512
128e3861837a33fe2edd4511fd882ed54d9a19049f1efe98a1db3219bcd5253353ffacedfaaaef866c6a6a3b57656fc75d85bc5b874e6046c76436140be50615

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
164B

MD5
3963215a628382a8e95e33ec176301e9

SHA1
c6916fd30dced27247b6d095ff7d8d98b462b104

SHA256
a883dc5f36dc0cf40722350902bc0f54c896a0a40ab0a4393b7760de4bca47b9

SHA512
453967fd7170ae383aedafd041c7f5ce44d16f18d22b0d60543517c297d0b6125137f8aa352594559b107b7c82814b00e416e3906277cddab9e898cbde237a90

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
218B

MD5
c29cb655e1bce142558ebac4849d1cce

SHA1
224fb69155cbaa316eebb87bf7c313607eac2690

SHA256
366e1c85bb9c39d4a8095e32874db794911fee6f004ac97742b7366c24eb13b9

SHA512
90fdfde61d8c60e7cccd42ae19fe70320bdea9048012febc43a88687bd3d42eb45c0dfc3b3eff317e18dc504d67d982a5b9f0198c65746ba3e284af1ab1dc89d

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
253B

MD5
f1e683dcb194d803ddfb0347ce731c5b

SHA1
8bf89425bcdfef64a0f056d21d7cebcdb99565b1

SHA256
3549c86951f8930971d291755d5ff3a27354bd0084355ca47406d21996bccda9

SHA512
cca7481193563f78f23229a56c7040ea5f9c121ab5742eef9f1e8f5ddcf7dabb101d02864c8a1595ea7314ae125437c1a37c4163ef316d4e8f0064ade0b793d7

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
936B

MD5
5183de836c76cbfbd6433ad682ee2889

SHA1
e3dd4df6d698d126e4c2f5d27edbb3fcdb970dee

SHA256
8ea6781e87a2ddeeaaa3787e9eff2220fd10e9aff4646ad50250d261f938d044

SHA512
2294557efc2b23ee08b226fee018145bd3467609f2d363596ed14420d44f1ba75e465c5b0e01fb81afeb30f9c327f52407c789073382abdafa50aca2bbaf6cd8

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
936B

MD5
5183de836c76cbfbd6433ad682ee2889

SHA1
e3dd4df6d698d126e4c2f5d27edbb3fcdb970dee

SHA256
8ea6781e87a2ddeeaaa3787e9eff2220fd10e9aff4646ad50250d261f938d044

SHA512
2294557efc2b23ee08b226fee018145bd3467609f2d363596ed14420d44f1ba75e465c5b0e01fb81afeb30f9c327f52407c789073382abdafa50aca2bbaf6cd8

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
aa00d1a796480450abd53cc391960d4c

SHA1
13fb92780f8147a783c43290990f133dfdab232f

SHA256
2c73ec23b7bd64367f5aba67f11da10a5573907f487e510aa841a492e7f2469a

SHA512
e74ef818f8e5b8f450fc45fd7c07a21e1c6259fbcc2123ce94fd1652095a3a3791933d8d20eb4d2c69b2527611ba21e7075bfaed5c7e36d53abdc6661aef1cd3

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
1KB

MD5
2fd6cf7344d91dd06894ccccf6872b2a

SHA1
96728646f342d8562fe6f476ddc36c0235a35c60

SHA256
0011e9b46efb06f6987e33c88bcc0336c33b456df88becf5b514ffa5b37a382a

SHA512
ecc3714fdc3f2b080ef81afcd50ddfad73ed77dbb045d246b31a8fb6e695fa8a539b0d86342f3156284c1804b59a2a1106f13fc386b09abc24f71577570f926c

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\log.txt

Filesize
2KB

MD5
f295159885a0b67c8c7749c4cefefeb7

SHA1
36fa4cdb2604e6bab755993c388bff4166638a2e

SHA256
70fefed10b1b0fce12fbf6ad430992ef040afff7a347b1bd83429914070c4b92

SHA512
214edec7449abe19ac34e92d755f509d03f56d38abbe908aaab2a5ba4d8b00df1b88a8e55498b01b89db06c6bbac4d46fea6765ac2f98e101659d010674401b0

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColorFill.fs.bin

Filesize
189B

MD5
6b99058f9b288d997c69d73861927134

SHA1
1c0fc93904a734faa7cc5f884d60a38ec24fbe6e

SHA256
f581b62052f717d462ccf51c1dd0c1f2a8bacefd1a12f9a47d62027e1b7723cf

SHA512
95097e5a5833fa64e25a1eff937cb9771ebfd2af1154f6b0cb3f787f40f35e2502538d6cbf2d8defa5f194d32a20d1365e92ba1850f5312c0177ef0168aa8dee

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColorFill.vs.bin

Filesize
377B

MD5
ade27b34719a1db3e2375f0a0eb3cd9e

SHA1
aa199069a3f46da765920bb209b8b14a3d85e926

SHA256
20d8f4943d855d2c5f22ef8ce81e0a17680379a767cb63f46e446cc882bedbd6

SHA512
e69621d39545aa19e67363f867c1c37f1d0fdf71de22339e8e5d784609b51cfaf7da87a8ae66602c44d5e9a84aa836e45e9af2bb4ce2ef4067d5a4bd3938b70c

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColorFillAlpha.fs.bin

Filesize
413B

MD5
2c008c39e1be5510e5a2c0b465f34326

SHA1
e57d76b14b6e451184d4e083a5a55315e8d30b44

SHA256
12fbadc4f1f8096578e92cc84f4f35d93860a5125c394e8105b8e20cd2d95cc2

SHA512
90e6aa621e7291751773c4fa1eb15a42fea09e67e64073ad3bc1f07fcbbda3976888a0e43627f126cff5a394207b0ef279a66225f411a80e38e170396e365d6a

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColorFillAlpha.vs.bin

Filesize
413B

MD5
1edb618d8e078ba86328b2a6ca92579c

SHA1
c0b2d1cd29ac6a97801d5bddeb7c6d400f3905e0

SHA256
03da02d677f615a2c480247639bedddc16a1c892fe47f9aa38ea99dffd32ef86

SHA512
03ae62e88eff7568fe5d96aed5eb112d8a80a64f15bc4b3a9bc145d1128bcc5bbafc5a389219d4e3516a68b5705f0eec8c2b568270587db466f1721c44ccddb1

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColoredTexture.fs.bin

Filesize
616B

MD5
4d5d1a09fd0ba4539234cda45d0522ed

SHA1
80f8088e975b40804a028a1b0431b2b6e8016fe9

SHA256
c60f25ab025863f7b511542f9ce0cd16193db2ae887db9144fab634d21c4e9f3

SHA512
2981bd2d518e83d47539c4ba5b3e005b9c70674fc2f0d0d98600d6c47db2d8b7259811ed988f9d1adde4b58c9985609fcb78c68f506de285eea434551420b850

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColoredTexture.vs.bin

Filesize
425B

MD5
4cbc79490c90928ccfebb56a8318eefb

SHA1
0754a60095990e61477cc70b4f806988a0725ff0

SHA256
9157cc875f439b19feb664b90f748d7c77d8e71dfd542eb45f873d1b9ad52069

SHA512
6d62676e0daf43f630b207ec7afb8848f63cf5a703691070c20f1c0f39547e7d5a16b921be8c9ccd0905d91299f4fceceea289e66ffc1a99f7762388acac38f3

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColoredTextureAnzu.fs.bin

Filesize
297B

MD5
73403a1ac5d7a29ae66921b96a684fae

SHA1
37eca11dd562da218f9c66818dcfac6189785617

SHA256
cae9cc9c5acd9cba08b59d8877e55b0d7d574547da0259c460e47a59b20bffbd

SHA512
e78a7720d6179048963ca72a01b15c9324d3e7a5439dfdcc825e46ca595e2d1e9ab1d1324cbc4dfd8665a82e069c5d67fd7dbaec9a5aa6a6e2fad783068a7135

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\ColoredTextureAnzu.vs.bin

Filesize
522B

MD5
65fbd3f05899b3b94473a5b2a3d763e4

SHA1
5cf673cb597e747d929e81ef6ffe72f5d418fd44

SHA256
1da5f99dde24fa0f475e7461fd3cae09cd13b3821e8fc74e979e6f492ef9d621

SHA512
abfb72dcff483f6febc2d7a58716a42b3dbd86dcc74701a0a7745d74029facefef8ab0365ae55efbab1fd0c4ff497c8dbcecf1fb16643bd1bbedd476d1c90b72

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\NormalTexture.fs.bin

Filesize
1KB

MD5
9b77937906a6a213da606823947e069c

SHA1
99e394cc6ecec6f8e5bd329fe785d210728478e3

SHA256
4d591aabddf8ae19d4e88c9804be37e004673d8a06059da9a1bfe077b490fbd7

SHA512
e778d0031da2332dd0fd5cdd3f51fadea2d8374159faec173b3dc35e863a3d640b19b7fc71208fd1bde5dd5b7d8b192676006fd03f44d8fcaafb3029d33af3af

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\NormalTexture.vs.bin

Filesize
683B

MD5
12c341b4bf041100551e832cd9888f23

SHA1
c5c50fb381995185bcd1804d3cf51b0f85f53f55

SHA256
5d977ecd6196184b1a1ffc13f39a37a8a385917b15b1134d8a2b828038d461a5

SHA512
04ef1679ad951d9ac9a2c8b481b032756a01397125e8e8e8e5ed73981669d305f378e50ee0c4d0208335b9a2d7f646abd4c087476a218d5b8412640720167222

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\VertexColoredTexture.fs.bin

Filesize
586B

MD5
1ceeb3d942cfec141dc3e1043bc6faf5

SHA1
7e30ae9bf46e1be49611e558e213104ef7c91195

SHA256
a7144c8c4ebba247dab1e1b3778467bbd514c8058edf05c227e14d8dcd8819b9

SHA512
ae850e79fe823b24a797628c74712df3a484d2b063a402cb16d50af2eb62a9d295cf8c83d17daa869751d723bc076bbcd8fb91ff5838dd6ebb9660f6bcfe0a05

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\shaders\windows\dx9\VertexColoredTexture.vs.bin

Filesize
473B

MD5
b319352e49cfbbd4984d61e5d90e88bf

SHA1
1359c61e91f7b833d0fa0af5615a8fda6c9e0eca

SHA256
de2b5c2e121e2634d455e93eeec4083749c9b036d7be9df327f60070955c780c

SHA512
9122b22ccbafc2761a81e0c34e2d5e5942593d562b7a5f26dea21ca8f1d0ef07436f01402c9e13909a6278720fd47feeda22870e46062724ec437f09396e7276

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe

Filesize
13.9MB

MD5
27b141aacc2777a82bb3fa9f6e5e5c1c

SHA1
3155cb0f146b927fcc30647c1a904cd162548c8c

SHA256
5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3

SHA512
7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe

Filesize
13.9MB

MD5
27b141aacc2777a82bb3fa9f6e5e5c1c

SHA1
3155cb0f146b927fcc30647c1a904cd162548c8c

SHA256
5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3

SHA512
7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011

Download Submit
C:\Users\Admin\AppData\Local\Growtopia\vc_redist.x64.exe

Filesize
13.9MB

MD5
27b141aacc2777a82bb3fa9f6e5e5c1c

SHA1
3155cb0f146b927fcc30647c1a904cd162548c8c

SHA256
5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3

SHA512
7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\C4GTZXEP\www.google[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat

Filesize
1KB

MD5
bfb404f41e74ad7dba8cb2f7fe3b1ba2

SHA1
2c805d2d51c7cfa678e57ed03b0af1f8df672eb9

SHA256
c9e8776eaf5daa35ae9444766ada84cd50527c328e2d25c10d71aad5f9a7e28c

SHA512
07314393092fbb29055455c00ea996c4549121a7d7cdc424c215bbb4f3e5e80330910da8d192a847a67d3b0a403853449a158145fcf1f14ec70c05e3b78f2c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\csn_hackv2.exe

Filesize
1.3MB

MD5
258fc3454a52b36ed6150f9f2a8ef0f0

SHA1
0e4bcdd3f8d607c918e80967b50704f6a2836222

SHA256
ff79d61d140c25e8c2fb2a049e0f8f67d058eb28f96a753c018befd56f6a7beb

SHA512
6b8cd79387f14714d40ff428ca25b5013bf638c673aacf802307cda3628e6eaa3868d8944006bd2a6f8cbf6e7443465789c323c8814b4254e02b10692ff514ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\csn_hackv2.exe.uy8b8kc.partial

Filesize
1.3MB

MD5
258fc3454a52b36ed6150f9f2a8ef0f0

SHA1
0e4bcdd3f8d607c918e80967b50704f6a2836222

SHA256
ff79d61d140c25e8c2fb2a049e0f8f67d058eb28f96a753c018befd56f6a7beb

SHA512
6b8cd79387f14714d40ff428ca25b5013bf638c673aacf802307cda3628e6eaa3868d8944006bd2a6f8cbf6e7443465789c323c8814b4254e02b10692ff514ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\csn_hackv2[1].exe

Filesize
1.3MB

MD5
258fc3454a52b36ed6150f9f2a8ef0f0

SHA1
0e4bcdd3f8d607c918e80967b50704f6a2836222

SHA256
ff79d61d140c25e8c2fb2a049e0f8f67d058eb28f96a753c018befd56f6a7beb

SHA512
6b8cd79387f14714d40ff428ca25b5013bf638c673aacf802307cda3628e6eaa3868d8944006bd2a6f8cbf6e7443465789c323c8814b4254e02b10692ff514ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\favicon[1].ico

Filesize
1KB

MD5
f299cf2e651c19e48d27900ced493ccb

SHA1
c2d1086d517d7a26292e0d7b32da7c55b166c23b

SHA256
115c8eb4840245f7aed0cb2a17fa7e91b86f79bb2f223a25af8cc533e1dedff1

SHA512
b46341bfbac50f48afcd2a4e34910901d722ce72f9f34f809916103e01d7ebc11bce15a28bf6449efd49ab9dfef1f84a94e3ad775cbe52d5822996674124b104

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
149KB

MD5
cb24862217a1190967938eb0e4976c18

SHA1
ea8057072014b63ac0d0e0d71dd86e5373f7e579

SHA256
5890c92a1fbbd9f16cc4da5587897e7375a39512dd569925b2c1d403b11861e8

SHA512
e550d3e62c7c3c169e8cc534d823333bd3e3bcf9ba35cd93156bf2dbf2b6684c011fffb48752bcfa7edf59c333e4c8d03799c468a44f7e00fa3f376a37768480

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\12733

Filesize
9KB

MD5
05b3db0aebdae3e479ae33352960bb64

SHA1
d830041d7d6bf3f2da798b3c6805f83060393a5c

SHA256
f6ca78ceb29b36f786ce718547a2326d93291003d871dc9ae40771b5f83f0f9e

SHA512
5c872dd91331ae06b2753b6ae02444a756d59caa471c112031abd6d3ae1acdeba081b76fa9e38501790df8a68fe9e991dca0d1f3a4b75d22e972646878feaafe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\15702

Filesize
8KB

MD5
0fa28173f254e4b8f7a71d7561d45f21

SHA1
734961856a9724a88686aaedb4f0647cd499aaa5

SHA256
24e12601ada3b1a5b80fd5b5699b4234c3221a43699bccbcdb891212b9633c10

SHA512
70e48088d954e209ab462dcbc1e413c04c0485d019cbc25b2e59e31fe7cb99b9d8248b7080aa0e305f85c5009681e1148a8be738de8056006f3ba47998704d2a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\17755

Filesize
15KB

MD5
ee5115acde09512391d7b21693a082fe

SHA1
a42aea78d8c51cbda96a67d4df446452ad1d16b7

SHA256
7a5ca2805307678e97b43c9dca5afccaa14d74ef6f63b94a4b1f669d19817125

SHA512
5c33c34a85bbc4d705fc838b6c6f7e1d10bf329ad0150795cfa1028701e6c865c061c2eacf164fe93e5ea6d9b3a10dce06a5e3d8122985392e301bb48b2ffc7e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\18370

Filesize
14KB

MD5
ec3c3af856540fd8626ed80810931f15

SHA1
198aab66ae933274385b9cf60dfaf805312abe77

SHA256
cf2f8e0b4e2219693311ed9f16d1219841d59d4c6dc3a253063f57df7cd65007

SHA512
37ad57324a3996c0497681a23f0f4b06529a923bb69cc96b9f3c640f4bfdcc980d5c68228ac7a75960a41155ad4fa77aa92ffda95f03c796f6b931bc53cedfdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\24173

Filesize
15KB

MD5
eb0b509be3b2a184b706c35cb66d8fba

SHA1
187deaed57b91c0f37dfc9f59951f57fc04bbd20

SHA256
f5c8b4bc205d67429167a61ff130d68664a44552f5f0bc6d5d1f1b262b22ede4

SHA512
8b4fb05744ac9b45f68d73d9f2b0eb46d99f9aa9d27b9bcd9083cda5677925dbb752b6e37517a1d81184ba0a63fd8019fded9dfc97bc66c6406ab4cce8292483

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\26517

Filesize
8KB

MD5
1368aa81a295bb9b11c0c4bb67420cf2

SHA1
b45092716f2d4d52c87f2e7e8e1a212c1efba7c8

SHA256
b4b368b3ecf47e054517f49a5fc402077dc074cc5a595d2cbca3c77f8ca43c80

SHA512
c9da698bce8d99f8c3f715a3d895e80860301ee6bc3882f4aa4f974a06f0f7ac63fa57c838ea032a6abd017e4bb098661d86782631381762aac2e28c694c86fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\28856

Filesize
18KB

MD5
46282d1a2cd6f1d358b667b173781556

SHA1
3c417a0ae88f0209e5c3dd5ee36ffd5afa90f33e

SHA256
58e8a0c1b1d75c537c7f98ab23bb51b63b96fd6dbade2e266a033910e6d43a1b

SHA512
084c528f2353d09b33e890bb5e37ecee5ef82d3f0b88cb59ea5f3c5dd5666080fc22c7c6f960889580e06f8980e5ee9a133994ec3fc9791735ae627027854d53

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\31789

Filesize
18KB

MD5
a4fd90dc89a4babf22c49eb91774d847

SHA1
474580ce555cc6a7913714347f4e1ff01f0dd3b0

SHA256
68bd7c1afca285b13efd963be4752c3914278e7557982d7cf614e447abdaf90b

SHA512
69cbd8e00992e278772decae89c5e9a5f67ca71d1cec44008f3750f0b196aca73645a695433ed2c4e94116075e9813f63e522683d022cc61a3c9a79ec4347452

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\32402

Filesize
18KB

MD5
bae4c7a32fb4fe52936e6a0e2ba7dada

SHA1
c9a1bbab35bcf67dbe3d6dcf127d5c29f905e977

SHA256
648a10bde787a6de3f632b9304b69038e236be5525bc69112a0ca13eabdf0d39

SHA512
e5ab35988806e2b339608e91e45a53898a9c7c83a2629e8fb4322cce759924dfd2e8f8140b7e7e48dd68488113db261fc62aaa652fe559961aa80407994d5c13

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\4758

Filesize
15KB

MD5
84939c3129e3a94e72bda591290b09b7

SHA1
d9584c15ce5d2bc21cf3905be5253b67fc420745

SHA256
179c9bab456555e2208f3930f835cb97be68ff0c482d59fe32280847ba0f6310

SHA512
4815aff07aa33e08b6d3f785f91c82c3918c351c8e8a4960dc8f28b41370c172d4a9af507f3b5abd5ab5949ff431fe79d79a6d9e4b3f605c6e57aa5ec35a506f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\7912

Filesize
15KB

MD5
c1a57675929c63f1612a55ee14e86eb4

SHA1
5bfa4e3c3615b5642378f4d73c49e8c95b246c29

SHA256
9f4dd4fca9ed91a17e7050b06ef518eb3e20208116c24d0cce94698ac48723d7

SHA512
e7373cb6f1516f62ab6cd46ecf3ca12d5d8b345d8936603a59608c5c9bcb71dd19238e8e79f3f9916042e0ef74d694c547f694e43e6ff91ffa7e78bc872c99ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\doomed\9509

Filesize
18KB

MD5
ebb1815461174aaf620a01574398b82b

SHA1
2478e47e9c116ee13286fedf49acc86dce26f247

SHA256
4fddf5727e7e8db62257ad7a156d1ed9d53d248f4bd80d89d762eb4ebc06a2d8

SHA512
0353b0cac755df24fa5403c4753cbbae0a777044229b23224a68175f8619106c56319d835db7b1f1a26d3651cca559df2f75b61c19e19279b62241d702d2d744

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\1FC7B9E4C8D88D29E7DB741BC2CAA3F670384E71

Filesize
60KB

MD5
6891037ff32ba76b362371549aadc51c

SHA1
4287e0746fa4a7615448ad3c37d0dcc22b6a687a

SHA256
569472a052e3fe68bd57b3a30ad4014e3b0a52bff7175b0ed208878beff6e8fc

SHA512
e49930069d3aea3c37f21c4827af19abdb45d337a5a83ab4c29912f82a11a53ca23b05a1cd3748e65d07255f84e5622784b878047b1e6fe1a3acb298f312c597

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\3750B6B68FC4D49852DCA9187D89038EF2A5E2B5

Filesize
6.2MB

MD5
7ffeb7785d2caddc03adfc413317db1b

SHA1
c66e399627640054c1eec86d3b566ba24193c27a

SHA256
04091847e94db5b4aa924fd9c7f3b08e21b8cd65a2ac01edc5dfcf17a1300ab2

SHA512
3de4130a401cae0092de7b278ae907a8e85caeb9c9eb473887b252ab68f23363f7783405226b0440ae4d614d3f04a999a658267dea04cfb2efaaace0f6520fb7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\3E0E99C4A23E49B51C85F548C5CFB1C50C49DB5B

Filesize
8.2MB

MD5
6d6db202a36704c3c303c1170ca0a0b3

SHA1
5082fdd8f2570a05aec1fbff15be91dee2ad30dc

SHA256
5731d36b5d9f387b185213e7b71d1e6ce25e732f20031ae5a5f38ff8a8c5b304

SHA512
28bd5b86c2f812ce388f2787192dd1f5c37c6705819528f618a11513246d7d60c21078cb60dadfb3200e955ef634f37b053382db1b837bf9334fb7e3a371b3f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\45B175656F39A9D2B3837ACAF71417318FE35B7F

Filesize
920KB

MD5
45c6c011658bf216893448cbd1e600ae

SHA1
7ccd522d7fb499955caa5ea432c6ffb1bf3f12a3

SHA256
b7cd13c7734cad0a7cef06ede09be57c5a5979bd2b0cf43c3f5d3c20a37b729a

SHA512
4449be48c1ead1d7b1c4e66ce88b1797947e39b5379dcd9fc2370c4d3c44f9ebae274824105ac4ef3ce41eba0a9116c0dbe31cef476bfb4600d083c36209b133

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\58D46C4012E4AD3623A4EA72BB3C1CDD25B3FF87

Filesize
14KB

MD5
b44c9482d618e54f3ac34bdc263a813b

SHA1
accbe5dda38c974351bb9b553e0ce6aba9a3d17d

SHA256
9fc05805a0b3324259e276db1030f51492b55d6d6f36a2bf89ac0bbc3654d600

SHA512
aafdb3c5f138ae93f856ac8e33f022d8af0708135dfa14cee5f4010fcd1212f57d698e7733f9bb29abb0a7ee04c4f9fe2decf87d36a0a3e4ecd8b2212afea5dd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\677B80A25A006EDCC273545819E7C8B9A97E5201

Filesize
42KB

MD5
8c0868c147cba0f7aec9426185b1675e

SHA1
b32573db42f54b2a0636510d1281841a377ae867

SHA256
d85f16de5b12d42a9304d12bdb4a383495ba948aff72e8484b3e064c29f421a9

SHA512
57a832611c23bb92ca1073531a1875cc8db9bb106fe1ec9be2bfd4781c7df7a732049aaedd1beadce1b1366218e86014b643426d268aeaae0cb68c9bc4cc1640

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\7B9AB78677CB6238E20A5E51B7B511E8E1C8B8BC

Filesize
14KB

MD5
a3a7cfbcebe0a14e85e3114d858767c8

SHA1
cf820e2d1a8781ced2b9f7a8cfe71194b663f1c1

SHA256
f04cc9c154a68185af401c935533f3bf5eb292bec53f6186532b244abc524b48

SHA512
9ee023cc231c60f3af7540a9ca49b4811e01b29a86507d0efb60eac18c9f5d8bb7ac60ee8ad0b3f7b26130ae0b7dffe1967f43c12210dcfb1949407e90a05f9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\83694C4B0C983BDAFFBCCD945F9254E4CA2AF6FA

Filesize
535KB

MD5
b133455e1b8a8da51b106a84b6b9ed20

SHA1
02a107c6f85ac7902917e111324ed7780605cbe0

SHA256
353a5eaf98238f55948775b54e7b6f2fe310c359eb1e13eed9b6e2d265a7e384

SHA512
eccd03dbbb23f0f447c0f21661c24c7db4d600c2dd8e586c56c495f69c6e0034327ed15cd46f672e8740fba33ae3d1a092b1cab4425d8de5bd8c85a76614d288

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\8DF6094C2BE41E8D9B9818B3037E4182ABFD1DD5

Filesize
5.5MB

MD5
8a561d3d38882c3211d10e79cfd4fd87

SHA1
d3bc3c9946168788de47f1fad22a8b56f376f0f5

SHA256
0c90ed3cc952a2f7b3e2a82334f267170d636a44acc71f7d6fe801effaea47cb

SHA512
c9c996fd94481298eebd98406072ee9b4d693824b8b0716af85feee7ff3b48afb1dd2c050ce2eab229d91daa0259d4355f5c7bcca92e5118d0c70d153d5ac186

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\D808B6B57AFD2254BB009A9D0D72A6CD7A1425C8

Filesize
8.0MB

MD5
d2f7f916d598aad9ed9016c871d0938b

SHA1
942a80334ad40ec139a79f9a45e4b944eb624972

SHA256
c16d9fe80090f33037ec84e34f71d2ec8ac88798a382300eab8f641491f83e8c

SHA512
b6ad71195b11bb6be6d004766b0735b70e01dfe4f7117fa4c95f1b4cb2691bdcb5055e85042fab48fd99e9903d7dd393a6a93fc0bab201235846f7254052d019

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Filesize
30KB

MD5
d33f375f9314b7acc47c3a3e68289c19

SHA1
690e2b0bc8d95f691bc6b77af784a036b63fb30c

SHA256
0525b4fb6eee692b068f7629021b851e76167a6419f0eb238e628bee74ed8c67

SHA512
1b0cb7def62571a73d9c1291b317605a06f2d78219a42f93837371c74e8e3793d2e8d997b0b2615560cfc095bec89ed99beb85b1e4a3157251d274647f89de9d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\jumpListCache\eXWJVAJhx6xInFoxVXRoKQ==.ico

Filesize
261B

MD5
f874852d50337d63834783f46a81e33c

SHA1
7802aacbdbc68c3e9efabfd90022ef38fc9e44cd

SHA256
21d54523be6772e2a59fc6422b968200d9b55b4137670ad03c9558e62380c966

SHA512
a1087fba85f1169e3ae79615e083ff469b0f212ee2b9e8b47f28b7166233d17424fb818be64ba45beec8d98f3f652c590019bc6310c9f1109cabe33bde653ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.17444\All Files\GrowGuy Proxy V4.25.exe

Filesize
2.2MB

MD5
fc5b56a6e37e827e590165f049ded8c3

SHA1
71194bc5b30b84fbf84e1597a8f94c73543c10e3

SHA256
d0ce8d2dbaff698167c1bc706a23fb1f484b262784f2ac2a163460ff2c99f74e

SHA512
06a4463035fc04805ca6f0f300e10b2906510f0fe108f200fdb848545dcec6568408a94a526a14f2e075321180b51a2ea56838722db85c12a001486364f2089c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\items.dat

Filesize
3.3MB

MD5
d456a164fc31a3c917817f3d0bd439ab

SHA1
9592df713aba7d4bf7933cf6b2a2f0ea1a286048

SHA256
0130ef1564cbdce36e35f644dd7a7b8d07fc81643700c8ac793bc2d9a5fc691b

SHA512
ad20e7c486e4a9823178ed6be8d101d4ca68f0e015ebd7a0e66e776c205894c22048698b68c612fd65de65b43f3dfc06cfda70aae38badeb04cd00da2f01cb43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\libcrypto-3-x64.dll

Filesize
3.6MB

MD5
ca61c4fa9653092d2acb0c122212c000

SHA1
1a4b54dd123d400d0a686c7a6d8a85b1c05bb030

SHA256
272390fdb62c4ec20db0832b9b0bbc356c963a24f37f1e910250d9496e56e8be

SHA512
6bb16b0f864cc0318850928c13f04e13f7848b8835295d5f02a74c0dec9405ac320e69f6b12c28d1e069522c18b3a66c5b3f62d4d8294d7d8912429753ae47e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\libssl-3-x64.dll

Filesize
536KB

MD5
832afffbf617dfc49dcfa23d4333ba20

SHA1
4901345ef174efe62ff7113690664c018b479171

SHA256
323c920a45d4f6fc5ae4f9c4042939967d13c8ba41b787eee47fa14d437e5284

SHA512
592f032982e66a2ccf0a1a47df7e466d84a200769cc5971b7a02b50d384cb4d0c00772e1938efec070f5e75473c510d5d6e494b9718d93575afd1dc67a22501e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$EXa3484.47335\All Files\readme bro hey.txt

Filesize
230B

MD5
1034ece06dc21cab3fb267cf85eba65f

SHA1
653243887a75b1a4d613258bcedb18e34b6d9a90

SHA256
8e777545fb18e26edd0f07bfb59475b11b96eca35d93de0cef48fdb599d5d846

SHA512
7de7ff6db0a04c5a39e6989a4240be5de2fd1993ef5df31916c8c744bd0811ade90e20e13555ecb245db0afe6400aebe916c48389948df41cd9c0251cb57b976

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jmz03d5.zkt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cert.pem

Filesize
1KB

MD5
d101d17414e832088e10e442a5d1b791

SHA1
1e285145381bd3370d9c5e742066f6b31c37f17e

SHA256
82d9484ef35beb9fdbfaf705be21ffa3b719399d0802ad081fbf2c64a0bf1693

SHA512
cd729b652c6f62164c394d82d014d2cc7071f52299256805f2cfd38cae48eb479324b08aff37d59f4e351091b45233cc8c25b00afade397217078cf84836d29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\flptiwm5.l4k\GrowGUY.exe

Filesize
549KB

MD5
dd0ca497a7f05ef78724039bc037ccd4

SHA1
b8fb60959868329967ed7ce554918a2b036c3caf

SHA256
b67582ab8fe7148049f50b8a16c82489947f454422fda4bf9b1e9729f57681e3

SHA512
6b0177a596e99c3da705344b775ff6ab4d5df604413f14a4f4642ca2c166ede5a88d4e6a1264b0b99e9479e90f914f20f0c6798b5306abea59ad55ac79148524

Download Submit
C:\Users\Admin\AppData\Local\Temp\key.pem

Filesize
1KB

MD5
2f4b405d98bca1802b956d727439f5a2

SHA1
82f3f6c9d3459560f5f621d7f2a8d4d3293b147f

SHA256
3bd9345760f05be95aef0e665cd9febff4d0d3737a5e3907aa8b89f8b333db40

SHA512
c352259db49635ac58fb83ed8a1313b9cb39769a05ea8ac7aa0df24c4a82de97892b8c3d438e8736b72c66f55a2bb2797b9c06d522398e57e311907d581482fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\InstallOptions.dll

Filesize
14KB

MD5
3e277798b9d8f48806fbb5ebfd4990db

SHA1
d1ab343c5792bc99599ec7acba506e8ba7e05969

SHA256
fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c

SHA512
84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\InstallOptions.dll

Filesize
14KB

MD5
3e277798b9d8f48806fbb5ebfd4990db

SHA1
d1ab343c5792bc99599ec7acba506e8ba7e05969

SHA256
fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c

SHA512
84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\ioSpecial.ini

Filesize
773B

MD5
49e388ba8bac14c43514099ca8016d6d

SHA1
688d3eb9eb8cb577bea5ae56b27ea1ca9aba6966

SHA256
e4fef03cd9b48beccf7d3dc6dbb5cd7e3c3875ee04a851296cb17749e94bc416

SHA512
e939c7e082ff69ff53c90dfd3d9e66670e83e989e65a01efcfc611c4dc0a153247ec3646657a23c21e33479de65d1f6f88170f1db139332dce83fa1254ed6537

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\ioSpecial.ini

Filesize
773B

MD5
49e388ba8bac14c43514099ca8016d6d

SHA1
688d3eb9eb8cb577bea5ae56b27ea1ca9aba6966

SHA256
e4fef03cd9b48beccf7d3dc6dbb5cd7e3c3875ee04a851296cb17749e94bc416

SHA512
e939c7e082ff69ff53c90dfd3d9e66670e83e989e65a01efcfc611c4dc0a153247ec3646657a23c21e33479de65d1f6f88170f1db139332dce83fa1254ed6537

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\ioSpecial.ini

Filesize
802B

MD5
de68dc4dcba6c7dcdaa8536a62ceabc6

SHA1
d4974717ac7bfa2dd3ae2149b680b1889bf67433

SHA256
1e9a1a0eecacaf3d7bf973274b292e3466cb01b79d696bad3a1817c162a824fa

SHA512
e852a8a27bcaf4be30d007fcb0f5c721eae64691abefdc75689e061bdb8c2e3162aca06aedc33032411f8c80cc25622f94a11fa80f96f29910002a3dbda42f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\ioSpecial.ini

Filesize
600B

MD5
f315dda527fac51a9042f936f52088b8

SHA1
8f245e1a5dc1baccba749d2096fffbd61e52b127

SHA256
f99afe348de845d5a1fc0ef51f346eb4d44f4e66ce9acd9b860d441ae9c4c4ec

SHA512
163cf505be008f7e367719b3634a6f60299d95b15bc8c202301c5050824ddbb5716719acea55ddb77f5e59da4c54fe31e9d86c034a4b89cc441fd747b2d90306

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssFEE3.tmp\ioSpecial.ini

Filesize
600B

MD5
f315dda527fac51a9042f936f52088b8

SHA1
8f245e1a5dc1baccba749d2096fffbd61e52b127

SHA256
f99afe348de845d5a1fc0ef51f346eb4d44f4e66ce9acd9b860d441ae9c4c4ec

SHA512
163cf505be008f7e367719b3634a6f60299d95b15bc8c202301c5050824ddbb5716719acea55ddb77f5e59da4c54fe31e9d86c034a4b89cc441fd747b2d90306

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
093aeadcb55063c484f5c3690f6e686e

SHA1
472905c851e64b413e487d6ce105a0a63a064e8b

SHA256
ac6cdae839662a83c2c94c59cc513e1b6a2dc51539d0a73e651c463000b41a41

SHA512
c6964814c626b141172f99e9436f0693717a9bdbe6f729cce331abb2c317f0cf5d4a893e41aff4527f410f692a7590a88da81bc0173610601ead11d2005ad22b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
bce933ba1877143b22073291e2f2e761

SHA1
d7eacbca7bdaa78f7b24f48f763ce8bf05159858

SHA256
f840287ff58062557a58045ccfdf128e79c1a5569707a60c8cebb8ea4bc32a94

SHA512
575d2118b957134d6fd91e13ec521fb3a9d7dacbeced1ee15719141f12cf4f5bcbba7bc8f8b2653261974bb2286c489eb20905998ece192230e31ac31d84142e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
0f4a2164a54ebb687a0b7c012af463a3

SHA1
83cee72030e7badb898ab51decaa81196b7f628b

SHA256
120ed21e4e28808e8203c749256063900c8d42cc6760bb7d556f1e5812083ff7

SHA512
42d604cf42fc2f86117ba59d17e51fb2afafa843d5ddb8d74dbf1c4624e2f15cce3ed749ffc54bae3e67b529c325c58e2969b14b5a925e064fc52f0b59d65254

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
1a7507b70a37a4b2aa20fb5f47c4477c

SHA1
3411c4ac7ac14105a944ebf03fceb01b73a12080

SHA256
0c581edd38b09780eee6c7db493d68554c350707171289bba8effe113ca58ec6

SHA512
138e29ff115e372c8ecde5fe9873db6fd90c5580ab5353fe321b59de8c98a4fc2100ece55c68ee6284320a2f42c000eb5ec165e7c2078016c14ad7e68ed8ffc4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\SiteSecurityServiceState.txt

Filesize
597B

MD5
943cb5b7d2a30c01f67e8ca9e6df8d43

SHA1
2ff4860a5dc152599b0ee84ac6b0bac324be523b

SHA256
f411593e06457d134293d824da16f5345e998efd048bbcd75b52c204baad6dbf

SHA512
621d660e4fac2f99ce4c038143017bfbb5de65b7cf607e0fc2864e310ae62efe3e9009223b4dbe551b2eafd1d12c012a0207b1b307ab0c295409241926566276

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
b1c8aa9861b461806c9e738511edd6ae

SHA1
fe13c1bbc7e323845cbe6a1bb89259cbd05595f8

SHA256
7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70

SHA512
841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
7fba44cb533472c1e260d1f28892d86b

SHA1
727dce051fc511e000053952d568f77b538107bb

SHA256
14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf

SHA512
1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
9KB

MD5
fcbf9d19fa8ca6534fa85cb787bc15f6

SHA1
c82285424015aaf917687659b3541f71d7d837d6

SHA256
0ad0b5532ec66968e78a7d79ffa45be2aed0dae63494075e1d696c28d708d11c

SHA512
5ea81dd8ceddad89d8a158d2060940e37327598d29c15a22d0eaa98c2411b7e998c585ffe00843070b68117a99565800548036b402396bc989bba852857d7676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
0e1f718278238fca3cb509f267c1546c

SHA1
b11884b7586d98ae111648c59cec9da1730fb878

SHA256
4c7020b8978d99aa489ec4808f38398fe2e0df1c3c76ac66aca8072fdf089eac

SHA512
e4b3df9fee6b3dab3dd7e659438070163b266fc3867c02ea3c0838904893bccbe533cc9f35aeb7e0ad41792e6f5b59ae5da4627b06c5d4230a7b165489337436

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
9KB

MD5
0d96ea99cf0dfe357c1c59dfb8c80665

SHA1
b23c511f1290d0c04306b52c72c6f49051b506d4

SHA256
42921b5799441a3364f766ddc47bd76d2afaa4fb65617677c811007920e573c2

SHA512
d820bf4b8334aea3b15a77bdaeddf94edbaaf17f141a4f8c9f14fdb8af4177ee7cc189e8a975d1da05814e1a346048d80490a2329569bbb2d5b23c97fe6e3ce5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
10KB

MD5
92f086daae317cddd11e7f6b0469fb84

SHA1
fea292922354ccf911035777d0d77a2d712ae9a0

SHA256
764be6b12b781dce7de4fd1aee51b02474c16e1a50739e6af7722f2fbac0f0b5

SHA512
436a58e9e7aa5f18016019725a44283ca2bcd29b1fc5179000b19abde1a65a2923cf2204f44371b41db7b1f53c7de59792c3e0fd3fb6d38abc1f415fd66e8f49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
10KB

MD5
7157ac72cb75224f9bf31b8159903fe0

SHA1
df7cac82f35656fb136d109f2c0b0c6577b97d28

SHA256
e50b269e3f5a59207eb3e9b640a20ee782cee465136b0858faeb7eb8bcaf47b8

SHA512
d5dd8c25e9a6a972cdb9c65ee89089208c685595ca13024110273858dc36f02d04089bede13e1050a158bf8b545360f0530b52dc69d0195a25b970a2dcaafe5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
7KB

MD5
585a01867914a7b8938db0ebc95ffce7

SHA1
028fc3dcebd52d277e6ed652ce66438a42cfa4d0

SHA256
6b7cf7df81d21f256e5f7889937d917c148710d6b0da9637de1047cfa4940675

SHA512
8d817da14c2261dda32255f8cd7d32c2791aed1a3e5e27e1ceb87909657ee16c642a2933265e208b10835174d2f01f3d267861d2361a4edd9368aede422e5d5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
7KB

MD5
13c21ea4b7fa8f79a27dab4b598c011f

SHA1
fe010b18ec984847445aca6d4fc124a273fa6be9

SHA256
933597fd27297f3483525b9ae1c105df3231399496b0d7092301d89bccdb6b88

SHA512
3553918cc870b334cce15bd8805fac99a0f2022ebf338a1bae929008e923de8bcfb83f99b0bf9e7fe6c30c49f6592e713b8e05f33d920d6a52044110d9e46964

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
6KB

MD5
3383e71a39bec836a40266da07b0375c

SHA1
c15651afe7bb263e875dfb23b0e17a42ebdeb7d3

SHA256
e0cb321b9b8633877b1ce91256ad9f49bf11ba3578b8c3ee20278043cc043a0c

SHA512
ebb917b5fea019fafb700bb81a38fda31547196b499ac4cc05300761b52930d3425b6120cf4b0b4b85429c374603c7df6ae4eee44b08c56b1a1cb2527d290c54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
6KB

MD5
1ab65708d223ccb6ccb71ac54fdfdf57

SHA1
889c10271a256eb754dc439eb6a81d99ca5d6d06

SHA256
0f3af77d15276070ecf5b5e75cdfaef6f06ef9bba3584ef327874a1acf225746

SHA512
5436467e15471b34c19ab19b76e576a2360f40a198685914252ace2c3fc3d02aace402589b986a942b767a54517423c76fe344bef88dfedc3cfbe4c43148c352

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
10KB

MD5
f2ecc741bc12511a043ffd350e5e0a25

SHA1
f013da79f79a7039247c362965d6aa12902e2950

SHA256
ccf93bb04ebaf74d5509c312493b396b4835687ac18dcddd7c8983107318a800

SHA512
7a22aa49f1b124db9c4268fc96d976b38edddc27a32e39dfe7581d7363a0a1cf57017ddd614398a1ca76aa37b9e977e0a6e4f370336f887ba2f6d89544fd9de8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
151ec0f9a286eb7ca3ceaad912320084

SHA1
f3d3c76bffa6b589a690a71770c19670024d76ef

SHA256
702ddd85f3e81b8d2b636a75cd4cbc1062549f8ceaa5cd89789d1509aa9e9262

SHA512
51f0ce69344aacc7f8a6e3d5410608a0b7dbbb8316b62e5c15a2793f4ca07d48db566abc8cb26597bcf950cfd7ca229ea2dd264b8499cd827419ff6600c7109b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
938090ec3bb6e412f37d5db634db8d56

SHA1
4cb3059007e48b9111bacadf4a568794646496e2

SHA256
6f254bd6f22e9de858752f9ecc0f4a9666660dc06dbdbf2994019a08eb3369f7

SHA512
eda747601219930ff27dedbf39dd3cfb1b773ce6746a44cc44e4ffb54399d0dc836e8c18f7e8ed610b409876f2685745aad6ac123beb4111e44e8882eb58bdbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6525cc7e1900749606b88d9e542eaf51

SHA1
1bed7084046dc581b0f96c4618818cd4c054d1b4

SHA256
aa07e82d2d7540ddc98152f04cd4408f5d54961c7abdb635cf178a5878fc7b29

SHA512
2182afffd7d36992f8a1910db2f5d4c672ce1b1ca5bbb82c19c6ea58bb8ca2c6bdfc76875db5fad07cef7abe955558ef919945691694935781754755af4a62f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2037ce7f7d5da2743a6c62d04795ecea

SHA1
f2495164c7dcc9ba7ba8fb7ac20f39aa2d31d6e6

SHA256
3f2ecee9f947ed0c9c8eaaf2c4c0fc43375ba1ba283cbc0df865d8860e59ba3d

SHA512
1bbf862f4ce852241129b2e6197e4644d9a23fb52fcab44a3ca20c8581d8a7dcac97d6c2c357907f7d22dfc1dba2abe67ce8b883612dfdf2670b962fb2c79db2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
94618a1df65d90ecaa366898f62facc0

SHA1
c4765892ac2853fe55785a47e2a4daf57fa26573

SHA256
0cc706fb7e7b241b627a92b42950d560232aece3ad4c5bed0a542b330a544849

SHA512
9156022047561fae2d600a9e9d25a90e683084dee6982d55073836e1249ac4996aaf8b27a23440e27c748e777bcb40072f5703dc14ae396a896f315b05ff0686

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
1704702de1ac5340a7a24c6235ecb321

SHA1
a494403b5871e6dabd386c521fb8064a809081fd

SHA256
b61808e41d53dbcfd691e600abbe611ddae5ebb958e4303b5a8ccb772906d4d9

SHA512
bde49c3f8f72ec6697781ff76c24bf139d30135199a89699d17c3ae3fc34169b20ce43566c146923e301f9ed1dd0f3dd146c6c3694e2b1a2065eabaab939e1d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e1056adca874433f274b585fb5e682aa

SHA1
359b6e36b78e92527b84c6a43f8e4a4c567ec632

SHA256
db2ca9378adcbf2497b965c0f57f449cdf81a772f9c1c3477b5e360ee231d118

SHA512
695ada2ae779ecf7211a23cbb9de1c6dc613bb06e59232ba03b7f8707aa2703250475fd03ea609601664a6ec750cdc1fe8074208ab6879039de98d752ced6590

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
713f14f57be20aeff57339f752a751cb

SHA1
c7d1fc406ddae9efec1e6caa21d8ae995d25bc1e

SHA256
eeb3232465060f192f43065b12a57e95a939a46127cf256e2497e8e5d0f90a57

SHA512
ce9265c0d97e1e122963b7a923aa835ccf3ae9d10f383eafc212d40185a7ae775ae3f3b034ca40b02fb716ba7a0dc4c1d94f4c3585bc6935f5269e1efae2efe9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6bb13a791ad125ddbe03c7f2566e2159

SHA1
f41682e4ff49cd257050e17d9d6b88335ed72850

SHA256
b76d08f6979929e2955e2416d6ca95d77f1615e79e8992ceffed5f8c1907f5bf

SHA512
67f4ff68f2634302bbc480d8a63db9c6c4855a6298619155b07b2638ded1f08fe14c845eb4c6f395fc6b677fa3ed6d24248256d584890cd2054cd640aa575a7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a230ae3b95d77c3055f365911f4c0263

SHA1
be764e178e2e7bf029f633a22c3407e5d316f36b

SHA256
934693f43c109588a06b7548908b0ee54d43cc311aed358f97e3dd1c29f20342

SHA512
7429db9b01947ed9ad02b0aab27838c5c6d98d6d05509f0c112a17a96413e5e261c1498120ee1ea3ceea7b6b59d096071e86165dacd21086724521e52282590b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
7664aa6d0cf8b42285f4fd08b17e45c9

SHA1
f2cc19a04047e62c1d7930f12eb73601dee667ea

SHA256
d43ed14e49707be23583f46302b37ce61dad194acf2d142f036b845bc7c59a47

SHA512
740cc0612cef490e3eae9c00646aec801f0b3e2e1747aa166795f1041c257c5478cac09761c868a480d2998e4537e09b6dd5069364cde3f675163cc9e39ae72c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
421f4740d093004213f6559f717b787c

SHA1
475805181c0ff1aca4929d802ceb107226cff43f

SHA256
8ac5deebe5313eb035eaea6ec6d2d42ff7df258cc0e2b192ecfc5624c59f40ef

SHA512
94f1e0c2314f07c46e75170fc8911e80560b7fd8c5d6ae3b7e4f6b6e10c41cfbe63dd824e3371e141abb16e0c442fe8a197a989964d99024a18111b49edf8528

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
6375be0235b95f96c08fe80dad143aba

SHA1
d540caa613314083554baf4a3cd96d0624d7fdcc

SHA256
6710f379a9c9c26030512154d61970329d1efa3992f8e118e66d8f12efd4ef63

SHA512
2775ef01325a713a72b424060df36c0e58ffb3f7a00d551b774a5c98dd3316a74feaf15a8eb5163a04fc521351074eaceebfc910db9d84a840525adfa4a61091

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
06e12244831267d3daa409999a52e8cf

SHA1
3b3de3342fd0ec52af16ee6f6a23190cbc9c1d72

SHA256
f6f8f2d8db37a5c953080d37bf1bb1ef20556a32d81423322cfdb19183aa4b6d

SHA512
a3beb48ef407164288d04b8e7f408e6f4c9811b0e75afadfc9895f1890b8a2bd45af7627508c0308bbd19d763361d412049af34dde95df83422515e71e99aeb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
4523620114d333ef2899556d6912eeb8

SHA1
1ff0e4275a833bae309bf785ff4bf957bb87f66c

SHA256
e0a618b8a1803152e19249338cc3b7bc9d517db429d0665fd9a52cce2719485b

SHA512
4d8a3e62cb2f24550d03e1b22171d1a2215947c430fdd4aff27058ce7758fcc14f69ab122bf5d5322455322910cbb6950dd76f6f187b7f4dd4fc9f86c51c19c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
0249655a178a15531ad6c689f5455810

SHA1
512dff71575da669b308cf356c9f4f179eac5965

SHA256
075db59f4d89568c542c3df6ae43300e24ee7da38a3e0ac8437b2a0920c9f73d

SHA512
a9070718e3d3cc389841aeaf717782f27751e968ff3a146cf20505338391c21f22aaf448b5bab525951617e8cb9ebc4cc9d31a88cc0a03d49ed68d3bae2e4f71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
c20aaff0fda79d2d5730c22096d7d977

SHA1
2fb4caf25ea86d8131a484b3f78438bf8c41f527

SHA256
607075fd0a35ee5d49f19a01ec71d901febf491b1613872d8d074cff7d769568

SHA512
313d15adcce75156eed74a45c1745d5b17d260c4e7b82c534d05f4892be8613579a93b44e6827a2a59c7d1260b86e7962a548d26c76b555732861f870f1c4049

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
1353306e150b732b5728fb7643547ff2

SHA1
27b489dde6053705d288645a0854b6117608d7cc

SHA256
898d7fcfada570e353ba8eb3fe767b869163a90bf0e09a96f9feeaa4d9fd3f44

SHA512
5f37cc6a5fb419dcdb02363ce3a57abdf132394e777b7a4978a69089b306460db6873e2a44c0a062a9ff8a77f9e253dd4f12b904dd8b0ea7ce60308354ddbdb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
9541dac1c708a15385d1afb7badb4168

SHA1
b4fc24f85dbb8f0c7a3c13218afaf87b57cc50a0

SHA256
837ef91407fee9839cab905dfbe7c876e3b2d8f53f88f40b2a6b68bd0296bd90

SHA512
99d52478b9880ffad1d96c22b90d85a66c35f382ac1289e74ef4d9e549e92cecd79388d8c40a670b839173f24f4d9200112c31ef7a829dc0fe4695c519287e25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
57164ac4815876fff18e7317ecfaf864

SHA1
c46e84edfcbe7265fd80256a47dfefe89bc9d66e

SHA256
5dc0cf01c3af44ffb4886ce4c3d52a626a1849c1a555736de8072e1f2da0699f

SHA512
3838b9a64bd36269337ba6e12097d3bb9904f895a1f7372e013501132578ede8c8ef8958a2af0f5a9aecd7b3d784346d57ea592dffc7154f97766cc050c78d1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
bef67e82e8ead66424ef10948611bdf6

SHA1
16a3df339e08836e84d4835f875b28a6fa4b59a7

SHA256
893605a2a166e98fad26db23370a4666347cc1575263657d384be17de05768bb

SHA512
490e1e2a2c82a0876f217e2c9cd1c4cda3cfaa2b135794c793408cb52a409bcafe623c6bae6913ec55d5b0a48d9d4ff218ba6bf66a1807a6a3340f2f92919a57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
dbfd2b1288ad2c2aa8ada618587aa36a

SHA1
05cc542d46c9dfc9eb9232b6589b6c1d9ddbc810

SHA256
45eb449d1820ea3998dab45df8d8e1f11e5c345fb2576c57f9b32224d03dcb91

SHA512
71ab8efd0489f7e87d5c7812fa93d104a16f253e9f2adce79831f848c3ad6e9d4c0f216cf94b44eb59f2c9f174e5b0aa48c60a8d52be6d46c3831f30ec3a7746

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
d3354bbd79f102954d80d010d1b9773d

SHA1
9bdfabecd037f696423a61336663541caa3494b0

SHA256
bd017216eff6aa529b91e89108266799e04a43dba54a91f51d25260ab5a5719a

SHA512
d9a300d3c011b0e512fccf58a35cb8ed5fc8d1f49345a73dadbd6cff57d39310a8afce8f91bbc2270e6e35d79c61e6b35048352530eccbdfa90487b64bfc957a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com\cache\morgue\169\{7b1d9ad4-fcef-4d8d-b870-0f773be315a9}.final

Filesize
71KB

MD5
5af56e80d9a2d727d1b320104e6cde7d

SHA1
ba422be74c69336070d260826553042393af3c77

SHA256
e2607bf057f340cb64f6846e9b3db376b4c5a0e991083c03773c71b587715a6d

SHA512
4108f2b9f1658e7eb16f0d14967853e3a0631b2dd00de575795af5edbf95c8e2c05ea3de21eaf8da24dc195eafea08ddec01c9508e5927290dcbe86d94c8bcbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com\cache\morgue\221\{3ce61d6d-a83a-4582-8642-416c0090e7dd}.final

Filesize
3KB

MD5
9c15d787a3d03020cf72f3426fb822f3

SHA1
5234715c35b7dd9eaf70c40a291d933cb1d2e60d

SHA256
37647d1e97719d01933fb14d291875bc84d58bdac25bc8bb980a608c83a6a670

SHA512
fe1479c0777dc69a06de03ca0e8defb4b8bda4b42442569a033c101bbe1480fd2b0d7e32b9fe6de03810a6d6050208a3d3a14069b89618d4c8eaac7e01720935

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite

Filesize
48KB

MD5
ce0c0be49a31e374ba58b2f34827e099

SHA1
016437f2668b744d2d9a948728838b3683348af0

SHA256
80f30101546f5375ddb2729a8de100d4b6d4bf9b54cf24e2c48f1ee82297be71

SHA512
dd65c5f0247a4b9edc6f4b0043c57bdcfd64e8e7b977ff0d8de71dbff309fb6f2be5f7c12846e9ce2f4a47964f91c8d101120c3598861c1e34aea65163bc710f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
52KB

MD5
7b30fe7928bd1c026f62b87683cbb97b

SHA1
92a8ca6b1f84abb0011b303c2a9076391b723c3e

SHA256
e5e626c9b196383eaab860dd007cbfee580e8cf182693d537befaa04785a9c3c

SHA512
d0e6f5b620165864382c62c17b138955d9773ad5b416f5d27208e7304f4918b475beffdea40581521f1f7f5a72a47766332656daeba4b0bb6e7b2b3ce9e13046

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\default\https+++www.youtube.com\idb\4185415548yCt7-%iCt7-%rbeesep0o.sqlite

Filesize
56KB

MD5
0edc3d78c3f37acb957f6b03e416084c

SHA1
ed15d6c5e7a3ce2c34916988dfd4d331280fd9ef

SHA256
a01bee108c7cdd23711112c2a2422d642ea6cda042a83e0bf3f16a1b46f43627

SHA512
86108c97fd2e1befa465b6157040464240bc09878dc386cad4ff5dbeddaa6ea53c72845bf9f1f2924e12430f69421959e0796dfd66e941cc3f42fbdebca4396b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
248KB

MD5
89c467c70e4edab792f67f00451431be

SHA1
5fa0e68602ecb8d838be4147ec2a16eb89b30267

SHA256
a658bff1b3dd8cdf5c09fae2bdbfc7021d837a68d8cfde5f09d544b13a0b71ef

SHA512
91c03aab86c4cf95f31551ce5a447b8ec4fa37707a1178a5e58edafaf96d9de8b959cd4c164b409542fa0f2513bc380d392811c23fc0a9e1e6e2084cdbf9ce4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
248KB

MD5
ed4f33c07b26c6326c5b24879cd78540

SHA1
05109550db777d89e2fc26d6acfd3b2ef3e6cf12

SHA256
3ea5dbd2c0e8924385bb4d52d6523544f7884e285fb07403a638412020e81f6f

SHA512
b72547bf25c11959bdc1cf94febd50b47de53d139e3eea32cde4ec8bbe81244f4bc49fbd8088d688285f2790ac3e614ff44de24fcdd4ea9c42988c57b525dc34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
800KB

MD5
77eea41de7582e3b4c2826ccd276e1cb

SHA1
68e88a6e511f36c33a238687123c929c4cf0bf4f

SHA256
e7cf3e3716e371286b1414518a0e6cdf1b0d9271914b0cec82d05bc12cf98aab

SHA512
ca0a4d342eb04cba33fe91f75f3712ca97fa814b540597c1ea853a3dfee9379d31cffcef036a3ec36b68f4ad908bc69a4a68c4cb0ca0257135dd3e2b38c826c3

Download Submit
C:\Users\Admin\Downloads\GrowGuy_Proxy_V4.dZy3eQVr.25.rar.part

Filesize
3.0MB

MD5
e2705040724ed4e80bd4b054992cef7d

SHA1
d787a442057f5b18c1417b0d2cd6c85705b1ccd1

SHA256
0376a8011e28b9f30e67c945aae6a6920995c4f4a4285a43bde5f196d2c79b4d

SHA512
c969ec7be560497222249b932d0ad71ed0c79f678e6ca780229680dfa9f4a16835c79a41b35357a4b150e3748c46ee7cdab7e5f9f12ba0c99024c7742f8ff3d7

Download Submit
C:\Users\Admin\Downloads\GrowtopiaInstaller.bfwL5Gn1.exe.part

Filesize
209.8MB

MD5
2dc780e4f1785041457a18ca7b3a3e76

SHA1
45b942b5b26548965d1a9cd93feeca9051bac62b

SHA256
86004dc38c1e66fa8679bb5e6d5fb45f1bb227a0ea399dbe8e4d83d020d3981b

SHA512
107fbf5529033ffe5e79299f18c2eda354b09b0414a58ffbce71733bd9719888cbfea6f8a6326492c70e042dfbc8ab58d55af2d0a781d44eb025b96506f98920

Download Submit
C:\Users\Admin\Downloads\GrowtopiaInstaller.exe

Filesize
209.8MB

MD5
2dc780e4f1785041457a18ca7b3a3e76

SHA1
45b942b5b26548965d1a9cd93feeca9051bac62b

SHA256
86004dc38c1e66fa8679bb5e6d5fb45f1bb227a0ea399dbe8e4d83d020d3981b

SHA512
107fbf5529033ffe5e79299f18c2eda354b09b0414a58ffbce71733bd9719888cbfea6f8a6326492c70e042dfbc8ab58d55af2d0a781d44eb025b96506f98920

Download Submit
C:\Users\Admin\Downloads\GrowtopiaInstaller.exe

Filesize
209.8MB

MD5
2dc780e4f1785041457a18ca7b3a3e76

SHA1
45b942b5b26548965d1a9cd93feeca9051bac62b

SHA256
86004dc38c1e66fa8679bb5e6d5fb45f1bb227a0ea399dbe8e4d83d020d3981b

SHA512
107fbf5529033ffe5e79299f18c2eda354b09b0414a58ffbce71733bd9719888cbfea6f8a6326492c70e042dfbc8ab58d55af2d0a781d44eb025b96506f98920

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.uI7PXWOV.exe.part

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
58B

MD5
16dd3b42d0f061e86140cbc28f5de665

SHA1
95990a78c54a4c3c9096c383fa1af486235e07a0

SHA256
eb3bc2bda448476e89ea4d1bb5566de4f5dbea4d67767464b53aa62a74b758b4

SHA512
44233f8060949a8d3ec8b0e014ec6468f9b1243c5ce80aba67597d3c89fc1f390229a23b3e73ee3387196f137677300b7e65dab9eb9da3ffcb8d539940a018ce

Download Submit
memory/1100-5766-0x00000206D1C00000-0x00000206D1D0A000-memory.dmp

Filesize
1.0MB

Download
memory/1100-5701-0x00000206D1C00000-0x00000206D1D0A000-memory.dmp

Filesize
1.0MB

Download
memory/1172-3113-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/1172-3126-0x0000000140000000-0x0000000145A90000-memory.dmp

Filesize
90.6MB

Download
memory/1172-3124-0x00007FFDA9010000-0x00007FFDA9012000-memory.dmp

Filesize
8KB

Download
memory/1172-3125-0x00007FFDA9020000-0x00007FFDA9022000-memory.dmp

Filesize
8KB

Download
memory/1276-5674-0x0000011D3DC70000-0x0000011D3DD7A000-memory.dmp

Filesize
1.0MB

Download
memory/1276-5675-0x0000011D3DC70000-0x0000011D3DD7A000-memory.dmp

Filesize
1.0MB

Download
memory/1396-5542-0x0000000140000000-0x0000000145A90000-memory.dmp

Filesize
90.6MB

Download
memory/1608-6834-0x0000000140000000-0x0000000145A90000-memory.dmp

Filesize
90.6MB

Download
memory/2252-6769-0x00000151EC960000-0x00000151EC970000-memory.dmp

Filesize
64KB

Download
memory/2252-6756-0x00000151EC960000-0x00000151EC970000-memory.dmp

Filesize
64KB

Download
memory/2252-6757-0x00000151EC960000-0x00000151EC970000-memory.dmp

Filesize
64KB

Download
memory/2252-6765-0x00000151EC960000-0x00000151EC970000-memory.dmp

Filesize
64KB

Download
memory/2252-6770-0x00000151EC960000-0x00000151EC970000-memory.dmp

Filesize
64KB

Download
memory/3704-633-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

Filesize
64KB

Download
memory/3704-628-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

Filesize
64KB

Download
memory/3704-627-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3704-618-0x000000001AEF0000-0x000000001AF40000-memory.dmp

Filesize
320KB

Download
memory/3704-617-0x0000000000340000-0x0000000000458000-memory.dmp

Filesize
1.1MB

Download
memory/3784-5413-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/3784-5406-0x00000000008C0000-0x0000000000ADE000-memory.dmp

Filesize
2.1MB

Download
memory/3784-5454-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/3784-5453-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/3784-5452-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/3784-5412-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/3784-5422-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/3784-5420-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/4664-6729-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/4664-6719-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/4664-6766-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/4664-6768-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/4664-6767-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/4900-6335-0x00000262BAF10000-0x00000262BAF20000-memory.dmp

Filesize
64KB

Download
memory/4900-6346-0x00000262BAF10000-0x00000262BAF20000-memory.dmp

Filesize
64KB

Download
memory/4900-6334-0x00000262BAF10000-0x00000262BAF20000-memory.dmp

Filesize
64KB

Download
memory/4900-6345-0x00000262BAF10000-0x00000262BAF20000-memory.dmp

Filesize
64KB

Download
memory/5280-5423-0x000002303BE20000-0x000002303BE30000-memory.dmp

Filesize
64KB

Download
memory/5280-5435-0x000002303BED0000-0x000002303BEF2000-memory.dmp

Filesize
136KB

Download
memory/5280-5443-0x000002303BE20000-0x000002303BE30000-memory.dmp

Filesize
64KB

Download
memory/5280-5442-0x000002303BE20000-0x000002303BE30000-memory.dmp

Filesize
64KB

Download
memory/6288-6388-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/6288-6310-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/6288-6308-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/6288-6311-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/6288-6312-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/6288-6378-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/6288-6387-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download