Overview

overview

10

Static

static

3

FirefoxPor...af.exe

windows11-21h2-x64

10

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    825s
  • max time network
    875s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/04/2024, 10:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FirefoxPortable_124.0_German.paf.exe

  • Size

    128.6MB

  • MD5

    78d73860b8402516a1da03ea38b94de6

  • SHA1

    5acd6fd1db7e8792bd0c5f8c7bbab9e826d6cf1c

  • SHA256

    fbd14a801dfd7473447ff77e13e8a0a0070459ce871b1222ed38faa9c67ef210

  • SHA512

    2f95c4a977569dc5d8272c778aecc595f5317fd6b1531fee181a607b05fad76b4c33760cd3d016955b96c3c6b12de2449ddc59d185c31caf48a57fcb46904c1c

  • SSDEEP

    3145728:XtyKufiNMRj5G306aqKTllYe+T2bfrTAHOi8UIqZ2fj:9yKybfG3RglFTHTAHx8U2j

Score
10/10
macromacro_on_actionpersistenceransomware

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 17 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 51 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FirefoxPortable_124.0_German.paf.exe
    "C:\Users\Admin\AppData\Local\Temp\FirefoxPortable_124.0_German.paf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:1712
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Enumerates connected drives
    • Modifies Installed Components in the registry
    • Sets desktop wallpaper using registry
    • Checks SCSI registry key(s)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        3⤵
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.0.1579111944\531038023" -parentBuildID 20221007134813 -prefsHandle 1776 -prefMapHandle 1768 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb16d0a7-d540-48c4-b865-4d36e02c127d} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 1892 17acc2d6a58 gpu
          4⤵
            PID:1452
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.1.1615442754\1811294283" -parentBuildID 20221007134813 -prefsHandle 2264 -prefMapHandle 2252 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {772b60ef-2fed-419d-b578-66e7c5e4c22c} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 2276 17acc1f1558 socket
            4⤵
            • Checks processor information in registry
            PID:3016
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.2.479141401\1333428522" -childID 1 -isForBrowser -prefsHandle 3484 -prefMapHandle 3480 -prefsLen 20860 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {973f4935-dd10-486a-9228-00702b401d8c} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 3496 17acc25cc58 tab
            4⤵
              PID:3328
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.3.849435107\1218928679" -childID 2 -isForBrowser -prefsHandle 3128 -prefMapHandle 2908 -prefsLen 26103 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9c2a668-9475-4f93-826c-a7ac6ff428f1} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 3116 17ac0268a58 tab
              4⤵
                PID:3508
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.4.1716746062\1562879184" -childID 3 -isForBrowser -prefsHandle 2824 -prefMapHandle 3908 -prefsLen 26162 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f56c7e50-af64-458e-817d-6535d225f618} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 3172 17ad34beb58 tab
                4⤵
                  PID:3720
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.5.216301156\158796572" -childID 4 -isForBrowser -prefsHandle 5024 -prefMapHandle 4960 -prefsLen 26322 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74393c83-bf4c-42aa-8dc1-750d1bc7965f} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 5068 17ad04c2058 tab
                  4⤵
                    PID:5160
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.6.1606740649\884381604" -childID 5 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26322 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b613a29-581c-46a7-b3c6-d4ed07d275d0} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 5204 17ad04c2c58 tab
                    4⤵
                      PID:5168
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.7.2081780493\1100618393" -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26322 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9df6b17-29b4-48de-99fe-f45f868a9c9d} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 5396 17ad04c3e58 tab
                      4⤵
                        PID:5176
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.8.2103334305\2105011076" -childID 7 -isForBrowser -prefsHandle 5844 -prefMapHandle 5840 -prefsLen 26322 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a420c212-395e-4cf8-8418-96c1511f3b56} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 5856 17ad4ef1658 tab
                        4⤵
                          PID:5828
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4392.9.1481847002\660847266" -childID 8 -isForBrowser -prefsHandle 3464 -prefMapHandle 1624 -prefsLen 26762 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db17f16-b149-4a5a-8acd-3c06e1361a1f} 4392 "\\.\pipe\gecko-crash-server-pipe.4392" 4736 17ad4aba858 tab
                          4⤵
                            PID:1072
                      • C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                        "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
                        2⤵
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of SetWindowsHookEx
                        PID:1644
                      • C:\Program Files\7-Zip\7zG.exe
                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap29484:98:7zEvent23494
                        2⤵
                          PID:1556
                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\APT28DropperExcelDoc.xls"
                          2⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious use of SetWindowsHookEx
                          PID:4936
                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\APT28DropperExcelDoc.xls"
                          2⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: AddClipboardFormatListener
                          PID:3888
                          • C:\Windows\SYSTEM32\certutil.exe
                            certutil -decode C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
                            3⤵
                            • Process spawned unexpected child process
                            PID:4036
                          • C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
                            C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
                            3⤵
                            • Executes dropped EXE
                            PID:3300
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:396
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Enumerates system info in registry
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2108
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Enumerates system info in registry
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:3980
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Enumerates system info in registry
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3292
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                        1⤵
                          PID:4144
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Enumerates system info in registry
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3820
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Enumerates system info in registry
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3124
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Enumerates system info in registry
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:1536
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:5372
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3520
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4464
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3012
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            PID:5280
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5904
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3448
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4064
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1532
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1564
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2100
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:5216
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3540
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2608
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1124
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:488
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:6136
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4176

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
                            Filesize

                            471B

                            MD5

                            d92028267b7e417d490e8183869d5180

                            SHA1

                            ecc2a3b80db06ca49485565135519299919019ce

                            SHA256

                            0c1e4a8e318ae28ae3e5bcef394b1d0fdc67285515a18a5bc0ef3577a74bd04e

                            SHA512

                            88da63c6d4fe715169363d5aa11713b42aac97afa18ec68be883725bcef0e0f6a241a2e144a02b0c91d7388cb6bcffd34e278f12a58eb5f54da7b6d621c7f61f

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
                            Filesize

                            412B

                            MD5

                            05c0bbda10838d938f215c3435314067

                            SHA1

                            36dd7c33ccb0575a0ac7e628edfd745497a7f5a7

                            SHA256

                            d28715350192926712f391178619886fac84d5b34fd6c753dfa551df12e5574e

                            SHA512

                            fe4ddbac20938ad746cf53fcc709bad76c48d9d7a599d57f744f6eae60f53cc4d39183fa505932293311c09e8b05b0518a4709adfd1fcd69c4f2aab5e85c2f69

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
                            Filesize

                            21B

                            MD5

                            f1b59332b953b3c99b3c95a44249c0d2

                            SHA1

                            1b16a2ca32bf8481e18ff8b7365229b598908991

                            SHA256

                            138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

                            SHA512

                            3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json
                            Filesize

                            417B

                            MD5

                            c56ff60fbd601e84edd5a0ff1010d584

                            SHA1

                            342abb130dabeacde1d8ced806d67a3aef00a749

                            SHA256

                            200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

                            SHA512

                            acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json
                            Filesize

                            87B

                            MD5

                            e4e83f8123e9740b8aa3c3dfa77c1c04

                            SHA1

                            5281eae96efde7b0e16a1d977f005f0d3bd7aad0

                            SHA256

                            6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

                            SHA512

                            bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json
                            Filesize

                            14B

                            MD5

                            6ca4960355e4951c72aa5f6364e459d5

                            SHA1

                            2fd90b4ec32804dff7a41b6e63c8b0a40b592113

                            SHA256

                            88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

                            SHA512

                            8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\97D00B81-A9D7-427B-9DB8-C684AC67408E
                            Filesize

                            160KB

                            MD5

                            4c0444a323e369844fcc5a6924d37da4

                            SHA1

                            13b50201e62ffb478fc0eda0eded58762bbecc52

                            SHA256

                            9b5dd3e480bac3a6b8e366e4507669d73ff12203559ba94d3a00f25d011a8b18

                            SHA512

                            8315513f4b031565407419a8067338e6f74b21a5bf6902c93b0f8c482eb84fc620c75cd662f99005d337e1e1e09fdd5c18724f34a797c36f16db5814f979303b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
                            Filesize

                            323KB

                            MD5

                            67f36f3c0ac40b3318b0241f929fe06b

                            SHA1

                            7b9aee92f248b674b974a8469fd0b0ddddf6243d

                            SHA256

                            59f39c79c6f4ce39372c39f194fea499d0bf1eef2ecb2f2b7a941898fd7200f2

                            SHA512

                            d58458e054b4c202a887c57b234cdce0913ed83481237700d70ac51412273289d49dcf79c29f06a1b87749020a66a4b7b3a280886ff8ae0c60e5cbc9debef279

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml
                            Filesize

                            76B

                            MD5

                            0f8eb2423d2bf6cb5b8bdb44cb170ca3

                            SHA1

                            242755226012b4449a49b45491c0b1538ebf6410

                            SHA256

                            385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

                            SHA512

                            a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\Excel.officeUI
                            Filesize

                            199B

                            MD5

                            bb5b19901496babdc4c69b47ad4d23da

                            SHA1

                            16f128e7ef68fd7d568a3c832e24ea5820ed9524

                            SHA256

                            e65a3a0789d50fcbeef580aff4a60b0f0d7e8063221df5b3a14428441852b622

                            SHA512

                            99896b578daaf2d33334a33e115e7245c75d8e19ae5599d0334e4c5ecc10d02bdf2a6eedb23d9273d791ebd3a49309ef90ef20f82311d4d54fcfbb8dcb939fd6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
                            Filesize

                            24KB

                            MD5

                            8665de22b67e46648a5a147c1ed296ca

                            SHA1

                            b289a96fee9fa77dd8e045ae8fd161debd376f48

                            SHA256

                            b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

                            SHA512

                            bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
                            Filesize

                            24KB

                            MD5

                            085ebd119f5fc6b8f63720fac1166ff5

                            SHA1

                            af066018aadec31b8e70a124a158736aca897306

                            SHA256

                            b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687

                            SHA512

                            adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\69D22C42.emf
                            Filesize

                            12KB

                            MD5

                            01c9488f9742c4a24868b7a7223bbf5a

                            SHA1

                            e21395292a168aa5a3866118865aea52e35041bc

                            SHA256

                            3bea8295b1f6464ea417cfa969d24fde876c33c665ce100f100ff760fc7f593c

                            SHA512

                            80aa14b05ee8c9bfdfbff8bd841c97611c00ac7963b020f4fbfdc6d818afaa98669d85bc035f0ec2340ad0c50d1c741f4d6d093521405c04a02e832f665de0b3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6FC08B5B.emf
                            Filesize

                            108KB

                            MD5

                            dec597ecc19741ff34128a06737dda59

                            SHA1

                            fa8d6e0daa36516056ae8d0145e97787cd8001dd

                            SHA256

                            8999bf672abc83d9e1975b6df0f72fe9c262e2afd3f04c630202f355d9e32805

                            SHA512

                            79c584dfee0858aa2643ea719fa0747c7aa2c00cd3de2b63fa4cee458137267bc24dd495d1c1025a9227b164b8e2231ad76588ace9e12ca300e4f95878b85310

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsh2F99.tmp\System.dll
                            Filesize

                            12KB

                            MD5

                            4add245d4ba34b04f213409bfe504c07

                            SHA1

                            ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

                            SHA256

                            9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

                            SHA512

                            1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsh2F99.tmp\modern-wizard.bmp
                            Filesize

                            603KB

                            MD5

                            4df53efcaa2c52f39618b2aad77bb552

                            SHA1

                            542de62a8a48a3ff57cf7845737803078062e95b

                            SHA256

                            ee13539f3d66cc0592942ea1a4c35d8fd9af67b1a7f272d0d791931e6e9ce4eb

                            SHA512

                            565a6ba0c9afc916cf62dac617c671f695cd86bd36358e9897f1f0e1a23a59d3019a12349029e05bf91abfb7b213ef02fc5c568a2bfcde0e3896e98cbcfa623a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\nsh2F99.tmp\nsDialogs.dll
                            Filesize

                            9KB

                            MD5

                            1d8f01a83ddd259bc339902c1d33c8f1

                            SHA1

                            9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

                            SHA256

                            4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

                            SHA512

                            28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            442KB

                            MD5

                            85430baed3398695717b0263807cf97c

                            SHA1

                            fffbee923cea216f50fce5d54219a188a5100f41

                            SHA256

                            a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                            SHA512

                            06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            8.0MB

                            MD5

                            a01c5ecd6108350ae23d2cddf0e77c17

                            SHA1

                            c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                            SHA256

                            345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                            SHA512

                            b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt
                            Filesize

                            691KB

                            MD5

                            1b330a7f7cc348ce408c10b64c79a5e8

                            SHA1

                            e82ee9c54b78df69404f3fa75f8a3f703b72cb70

                            SHA256

                            4e77c794ccd2cb3a0139ce07f70e170b15bc1e618ac6959797cec889048b5005

                            SHA512

                            7a077b90802e020edbd545ed5726f1339052422026d9f3438592c35099ce1b168a8d2d2a6f3845ecb6422f54f388611f53c013ddaec74182ab98b7bd6b35682e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
                            Filesize

                            518KB

                            MD5

                            ba78410702f0cc8453da1afbb2a8b670

                            SHA1

                            1083245ac66d4261f526d18d4eac79a7dbd72989

                            SHA256

                            9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91

                            SHA512

                            7433785795c68faa74b2d34b734cf4c4564940fbe21cb9ddd6c0251378455a9ded4595055059d42b73e8cdbfe59f16b4b4d4100fcca94a440bb9520f4572f74b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\APT28DropperExcelDoc.xls.LNK
                            Filesize

                            572B

                            MD5

                            b9ceeb21d4e44def6ea4be0df9c9851d

                            SHA1

                            cd330df73a1704558b8ab1c3f7a6ffbcc8976160

                            SHA256

                            18c1d2f574de4abe5da2ea42cd7a8e7e25d602e81ed370667948c43fe252fc41

                            SHA512

                            c97b78d55c5213295d3ce2772d320a57316c4c71888b9dfa1c14b7e3759f79889eec8505a9bd773937067ac99fa8e1584e4e586445004143a12bb4414d81a4cc

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                            Filesize

                            273B

                            MD5

                            735e521c03a6381a1df05c7e63effc27

                            SHA1

                            33cefbde745e06803f60735388100404488a97bd

                            SHA256

                            ad98a4d158458bc96a2337e9bd90e70bc8e0ff520b5ba1661ac8eaad376a7b02

                            SHA512

                            a0979cb94cc4c17c5ba26bbf2a3e33737865607c5252d725fde00cdeb4597c6eb4098aac154d60d9a89ec4e09ab59b49e4f297c7e9998507c3f40bd3a498fb27

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                            Filesize

                            7KB

                            MD5

                            4049f03472d4ba31316a2a83eb844d4d

                            SHA1

                            206e926351e7473c2404fa5053c85733c4e9f58a

                            SHA256

                            aa120bac838609911076d20a899caf28343b92c67bb5a6c08a4977c123795b70

                            SHA512

                            99964f2a075d29e20951fc7e941d7c54e4c91ad2510eebd40c586e4f3c61e75d9d6267688611ce0ad7dcf7a3e8a7744126c1d54bd5235cca12cbd1a8c5b45c40

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                            Filesize

                            7KB

                            MD5

                            4c3fc33bb6351c33e9356cca152a56e6

                            SHA1

                            d9b4556b4f68858fe5445315db9834305f7ae993

                            SHA256

                            62a6abfe0a7f5e4c86673dbd81ac81a898921dc70045d5ba86e8d95c36b8795b

                            SHA512

                            86cf69700a90453369b5c930fbc859bf86b3c9913727ad0baf2a59a73330052df92ea20d53a1a9722cb42310b3dc869b4216c5abf50d962a4386eb10d81f8afd

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                            Filesize

                            8KB

                            MD5

                            903afbedca12fc6b0611b307bf912a31

                            SHA1

                            0a30470558a77a4a11fad01cefbf6db3666f48bb

                            SHA256

                            1edb3c90c7f4a6e770d8381c5c8bd75f161a579f30206fe5a6c4be633622cc0d

                            SHA512

                            0de1864ed7e791086eef2542055288231908978724964c9c0da555c392812e6b482e5b9d93602aae54d81e84f627585ece0f956ad493de44516ed3062920d73a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                            Filesize

                            693B

                            MD5

                            60120550fef7921bfb76a10637c7c680

                            SHA1

                            9c37bb5da95cae94127da749ea49865300c8e449

                            SHA256

                            c81eb455aa5a6ce722d096ecd984e178c0619d31fa0fae5ac785a759935bcbff

                            SHA512

                            d1ee26a19508210d39e37cac1fb239c4030a180ec031fc37de7d053b0a81bb94b417eed332eb353161bcb042d3745f9936950e457ab87659725720789c566a9e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                            Filesize

                            693B

                            MD5

                            5535f3b1752c517983f875c00f22bcf5

                            SHA1

                            fa2640e94d475f1b5516c2dbb8f6f5de08218e3d

                            SHA256

                            059d356f3799b935ead7f6aad916a8014b36f4bbc77f4a8936cd1e1850f9fa26

                            SHA512

                            c18ac3c6e5fe00bb25df9cc0e83d171a499e54178c5fa4c56943c7a58b17c777cc8d4b73a4c1afdca17157d5860c4516b9933b5ffc3d91bbc6a16ee00c4b461f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                            Filesize

                            24B

                            MD5

                            4fcb2a3ee025e4a10d21e1b154873fe2

                            SHA1

                            57658e2fa594b7d0b99d02e041d0f3418e58856b

                            SHA256

                            90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

                            SHA512

                            4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                            Filesize

                            94KB

                            MD5

                            9fc51b2b5f07a684085ea6a7365944d7

                            SHA1

                            06cefa61bafdfb9cb0f912692c9be7ba8e8ca362

                            SHA256

                            3ece1daab44043dc4d0a73b05ddb96843e4933de49a0383307bf1bff1b3af3bd

                            SHA512

                            d44db82691db425197ef0a9fa1532d35940987ae1d4be8948f51852fdae9da24ade2b3d33e6b5906bb7b08e7cc0dc1d75b0fe23696d8726b619d85c1a1763d20

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                            Filesize

                            163KB

                            MD5

                            1bd97a4df392a6a72cbe48d0c8332580

                            SHA1

                            cf5e2098bcaa69908dae135e49936dfd288f44fc

                            SHA256

                            4feddf18c2dfc94b569af637331153d81de2d35837e2c33df586e65bec7cbaa6

                            SHA512

                            55e664b224dfb2f5c5b98463755a6a04fbbea41efa9b1c9dcd71e1df2ad0af93cf470d511ac2988c6beff7159a2c18a18f13f1908056e0152b28a266ae2c1fa9

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            2KB

                            MD5

                            d06edf89552fc440fab269e55fc326e9

                            SHA1

                            a036df83895556e094100f2725617cf5495f172b

                            SHA256

                            458602691b4d221561e61d2d48ebedbfd79291b5085bdb6e5823a88faba7e5bd

                            SHA512

                            48a6d51611dccce98a56609bd22906be031fbafee82a4c8c1cc80fe63eda4f5415356d37a65b56a880dee03da70798530fed3a7c9c201ee9cbcbb454b73c8057

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\pending_pings\0e59f434-6d5c-4e8c-a162-335de18b87f9
                            Filesize

                            746B

                            MD5

                            003913b779c03c292cecce78e2c8d6df

                            SHA1

                            fc4cb350dc2fa0f3ea78bdbbf5c1b8ebdd41c479

                            SHA256

                            15900b42b86eea9a2e61cb870406bf82ee7947d473e2df59d7e2829097148b51

                            SHA512

                            5e3a624f7b4768312ef269ab344e375fdd84d51f9bcb8e1b10a8e29db6c1b25151c0a81882d426d0ed70a1c334e84d37991c53605fd048dade868a44ccb23e5b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\pending_pings\38abd2e2-6154-493f-9a86-f1a751852e47
                            Filesize

                            11KB

                            MD5

                            bcce581baf18fd57c8e1966059656c03

                            SHA1

                            f8b00190c55a08158366cfab8e8e1983a48a7d36

                            SHA256

                            885c10dae6fdf9e57a762c443b294621f09a6425b687a8ba89cae4a50cb08eb7

                            SHA512

                            91c610aaa93654df8d2fc04668348c091fb7503340e239225f70a47030a41bd0289f5f5b36a71f98431dc8b96f67905c4d23bf638d98e3a0e52521ab74958b2c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                            Filesize

                            997KB

                            MD5

                            fe3355639648c417e8307c6d051e3e37

                            SHA1

                            f54602d4b4778da21bc97c7238fc66aa68c8ee34

                            SHA256

                            1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                            SHA512

                            8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            3d33cdc0b3d281e67dd52e14435dd04f

                            SHA1

                            4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                            SHA256

                            f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                            SHA512

                            a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                            Filesize

                            479B

                            MD5

                            49ddb419d96dceb9069018535fb2e2fc

                            SHA1

                            62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                            SHA256

                            2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                            SHA512

                            48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                            Filesize

                            372B

                            MD5

                            8be33af717bb1b67fbd61c3f4b807e9e

                            SHA1

                            7cf17656d174d951957ff36810e874a134dd49e0

                            SHA256

                            e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                            SHA512

                            6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                            Filesize

                            11.8MB

                            MD5

                            33bf7b0439480effb9fb212efce87b13

                            SHA1

                            cee50f2745edc6dc291887b6075ca64d716f495a

                            SHA256

                            8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                            SHA512

                            d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                            Filesize

                            1KB

                            MD5

                            688bed3676d2104e7f17ae1cd2c59404

                            SHA1

                            952b2cdf783ac72fcb98338723e9afd38d47ad8e

                            SHA256

                            33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                            SHA512

                            7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                            Filesize

                            1KB

                            MD5

                            937326fead5fd401f6cca9118bd9ade9

                            SHA1

                            4526a57d4ae14ed29b37632c72aef3c408189d91

                            SHA256

                            68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                            SHA512

                            b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js
                            Filesize

                            7KB

                            MD5

                            b13775d79f42b44e2ce0ac0169e0a3d6

                            SHA1

                            aa0e5ee0ee7035e6fb9f421ad44b78dac6d18a32

                            SHA256

                            49ec269f9e88d9ad978cc21fc8d30ed40bd401197751ab08ecefaeb142b841ef

                            SHA512

                            2943679057fa901a367d9a732d72ca131728f0f47ee62c776ea1fde393dc9cc1b67536d08f692d8c592a11a56870eac3be0837ac6ce9eedc58fbacf82e7142c4

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js
                            Filesize

                            7KB

                            MD5

                            b078eb12954ce5ec1a6042cbf491c9ce

                            SHA1

                            22720daaaec384c969bff2f0e207227d09f048ef

                            SHA256

                            19620c45543299fc8284b9e632e3c35b4b34f6431c7342b888d81689d1d083ed

                            SHA512

                            b07ac68180ea576677e79dc7b8f6ac8d6ab09e12e72de11fefb1ec3cd7babe8f5ff67513ef0c52e0fb1ef882a99b0c719b7b077320f2c5fc8ddfcf95e2ceee9e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js
                            Filesize

                            6KB

                            MD5

                            d43416f0e74af8158a1d8db473141b46

                            SHA1

                            119bd991d16e3d998c5a3e3ec3e37043051ca763

                            SHA256

                            ad3773c2206258d5722b4a875cda02a87abeb9f3e8e2bae007d92f4cd4bc2e78

                            SHA512

                            1d2d755228cde9a9da2456486aa34d5dbc306ba8aaa9a4af6f708c4e9a1d2102bd656340550c46046bb5192caeaba61b346a3f340706d2ddd986b9d9ab4abb15

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs.js
                            Filesize

                            6KB

                            MD5

                            53877b13aa849b125762ae6ed44e2fb7

                            SHA1

                            2ece093f8c793c864b147ae3e104effa4f611224

                            SHA256

                            e5561b27127560cd35eb953dae9d5a40c6c5ff3bc38e44945f35e06bc159c6ec

                            SHA512

                            3e1d959e05c683cfc49331b259ad29be4033ed729b964d045c17839df4389a26cfe902caaf69be9840f896d0d01fd44e8311206f5fead0c3f1d3b9065bb202fa

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            7KB

                            MD5

                            cb6d842cbfdf2af4b1a8fb93a086d117

                            SHA1

                            bb1b8db55c07e28ca8f00497bac4541a31a2134d

                            SHA256

                            a818f035dbaba2e409ebebd20e9aa910dca39ffe24c03f3ca1dfbbb237a80032

                            SHA512

                            65ec6927e8922f45b001f1c7a378a77b23bc8507f9bde2e10b1fd0d5c0760496d14a9089674c365b2b443e265de0685366bf65a5f3d95ead5ee38a648eb69385

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            7KB

                            MD5

                            b808000a30a2506de3fb6fdb4e2707b7

                            SHA1

                            e1d48b1278d7cde9ee6029db9e5caaa1af8466f0

                            SHA256

                            c6f3bb1140b6df9d3c06e8793bfd3265c8540a632b633080751886d2a8c7dd4d

                            SHA512

                            ab09328d5338297640b3a3576915ce155cf9f1a1a5d20760046e58d8be5c9d9fe7f8c740481bc4f80f36e45231202fe86aee19432fbb1071d9ded013737972c3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            7KB

                            MD5

                            385d2ac144d70cbc7ca5a27889562950

                            SHA1

                            800920448b09febe1960d13fc4a30a9d6ad0788f

                            SHA256

                            4285d2a7a9513b177ff019bf0c5a4d0705d250d64ec1ff1d7cd4074e9d61f281

                            SHA512

                            752738637760a2669c60afb5d81fe59a560636ed92d68be245d3f348f9bb25c37f700df48669e2c3db99e3b59e65622f93e24048e000ac7823b8a0e152073c32

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            7KB

                            MD5

                            9109408cf302c1f98c1a90a9f0ef8ad7

                            SHA1

                            79c648cb5a846ef8dd6960f6bc57a4f02166d2b7

                            SHA256

                            7515b36ce42b2b47f0afe5e3c73144bf5622304357e943166a679309b73d9bf5

                            SHA512

                            4d15f7cb051934c0a0a7b7d48566a940fdc59035946d167b6b2282f96484165a0674a4f9b3177674d2e3e4607584ad7989dee17f799fea483059fda4311b069b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4
                            Filesize

                            3KB

                            MD5

                            76aed02e44e8418641229260a8d0ac22

                            SHA1

                            07013e033bc217cbc4acab9e5755aa9af97f1e1f

                            SHA256

                            639d1d91b01f44cc6c5cf26a5f6ce6931bb78f450474c17fa953c68b0e101383

                            SHA512

                            c06bcc0b28bf2b7a9f85cb30c4e238ebbc5e457ff7773814088cfd52bde8f71091bd84feed19c6db797688adb787514159c90d298d6f117e9676b98421cd8c48

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore.jsonlz4
                            Filesize

                            7KB

                            MD5

                            374c2e58e8e266cb6db5f2681fbbeadc

                            SHA1

                            6cf47070c09dc509b4e43b906da51f4508d83710

                            SHA256

                            74a3760e01b739035a95466d2a0011d8cfe0fa02ed937233d57f697549a6495f

                            SHA512

                            486ff283c709f348d5ee297ffa1716840f52f961145fb5618ac013c16381b30c4cfd469e9dc91fffd977ec5860860ae346caa26af07ce0c0d2466e5ae046393a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                            Filesize

                            184KB

                            MD5

                            e036c8064b421aad8f67ec80e0d18d8a

                            SHA1

                            b20b0b315b88b074b21e780186fa71a960675c42

                            SHA256

                            3a378cd9c43710d6904102d189b1437c3c74dba44e7066d213ef9967e899916e

                            SHA512

                            29977e55539c81e864f67400ce47a510bc5daa509d599f217acb298e08ad5faf27ab82e390f14060c95287693200074f3329613663871d46f0b172480fb6345f

                            Download Submit

                          • C:\Users\Admin\Desktop\MBD01A8E075\[5]SummaryInformation
                            Filesize

                            4KB

                            MD5

                            745854382b298e204103271f5585e067

                            SHA1

                            3a79382b7e31f5231a46d221893cd98d9467e834

                            SHA256

                            cdaa679ae7133a4d97beecb05de16bb1014ba1022023a3e21de7913c687e390d

                            SHA512

                            7bc8a621e748ea2f85b8f77c8648ce9ee7f968c4d9aa6ec281157934b772c5c8511b5accab2d4cb0040ba3cb954f4b6aa658e78a20047f08661a6bc9468a5a2a

                            Download Submit

                          • C:\Users\Admin\Downloads\APT28DropperExcelDoc.z6VfP651.xls.part
                            Filesize

                            1.1MB

                            MD5

                            5debb3535cba6615526c64e44d0f5e2b

                            SHA1

                            abaa744d9504c7f23a237f8220ac6a441016d518

                            SHA256

                            5bac7a020f173d6c35f73d76cd3745a36564dbb3dd32f2d5fc5021c353e76a54

                            SHA512

                            4435f4deebc2f03c3a5659d1a870699d22fdb52525829373cf3bc0592db04da967e14f1e3f001b1cc0b974f8bddb96887480bcb7f14f3172caba1382866676c0

                            Download Submit

                          • memory/1644-1088-0x00007FFAC5320000-0x00007FFAC5330000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1175-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/1644-1200-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1202-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1203-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/1644-1199-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1174-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1087-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1177-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1198-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1173-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1091-0x00007FFAC5320000-0x00007FFAC5330000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1086-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1084-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1075-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1077-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1090-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/1644-1076-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1074-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1079-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1081-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1080-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1082-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1089-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/1644-1201-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1083-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1078-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1644-1085-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1545-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/3888-1479-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1546-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1478-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/3888-1537-0x000002EEA54A0000-0x000002EEA54D1000-memory.dmp

                            Filesize

                            196KB

                            Download

                          • memory/3888-1538-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1539-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1540-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1541-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1542-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1543-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1544-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1465-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1575-0x000002EEA54A0000-0x000002EEA54D1000-memory.dmp

                            Filesize

                            196KB

                            Download

                          • memory/3888-1576-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1577-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/3888-1477-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1476-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1475-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1474-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1473-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1471-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1469-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/3888-1467-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1377-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1460-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1463-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/4936-1459-0x000001B1DBF80000-0x000001B1DBFB1000-memory.dmp

                            Filesize

                            196KB

                            Download

                          • memory/4936-1458-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1457-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1456-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1455-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1436-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1435-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1434-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1433-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1432-0x000001B1DBF80000-0x000001B1DBFB1000-memory.dmp

                            Filesize

                            196KB

                            Download

                          • memory/4936-1385-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1389-0x00007FFB05D50000-0x00007FFB05E0D000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/4936-1390-0x00007FFAC5320000-0x00007FFAC5330000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1387-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1386-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1382-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1384-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1383-0x00007FFAC5320000-0x00007FFAC5330000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1381-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1380-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1379-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1378-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1373-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1376-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1375-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1374-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1371-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1372-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1370-0x00007FFB07CC0000-0x00007FFB07EC9000-memory.dmp

                            Filesize

                            2.0MB

                            Download

                          • memory/4936-1368-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4936-1365-0x00007FFAC7D50000-0x00007FFAC7D60000-memory.dmp

                            Filesize

                            64KB

                            Download