Overview

overview

10

Static

static

3

fecfcafbc5...63.exe

windows7-x64

10

fecfcafbc5...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 16:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fecfcafbc51111738d330ff9d41e8f2776e811cec44f4618b82aeb48675a5d63.exe

  • Size

    1.8MB

  • MD5

    e4a532ee93f6f2a27f3ee4b409b381a2

  • SHA1

    2e25dc2c0f3fbcb3822aa475da9e028e0886ff78

  • SHA256

    fecfcafbc51111738d330ff9d41e8f2776e811cec44f4618b82aeb48675a5d63

  • SHA512

    f3cf34504f68596e5f443ff0f3267d39eb90001548cf58e4feadee90bf3eda2014ecbc49c9510af187c4c38a271934c9d2d83d33c38c51419d4c09d6dafccfbe

  • SSDEEP

    24576:WzkC6b2uYnsa5JXXkIKpFkXCnggjn1xnUOOv/912KjHthddTC6AzGSrhL9phoo0M:/HauYssX0IKlL+9YKjHtdm59pWF

Score
10/10
amadeylummastealc7c43939c9aa5default_valencigafed3aatalecollectioncredential_accessdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

amadey

Version

5.03

Botnet

7c4393

C2

http://185.215.113.217

Attributes
  • install_dir

    f9c76c1660

  • install_file

    corept.exe

  • strings_key

    9808a67f01d2f0720518035acbde7521

  • url_paths

    /CoreOPT/index.php

rc4.plain

Extracted

Family

lumma

C2

https://necklacedmny.store/api

https://founpiuer.store/api

https://navygenerayk.store/api

https://goalyfeastz.site/api

https://contemteny.site/api

https://dilemmadu.site/api

https://authorisev.site/api

https://computeryrati.site/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 34 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 43 IoCs
  • Identifies Wine through registry keys 2 TTPs 17 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 19 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 14 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\fecfcafbc51111738d330ff9d41e8f2776e811cec44f4618b82aeb48675a5d63.exe
        "C:\Users\Admin\AppData\Local\Temp\fecfcafbc51111738d330ff9d41e8f2776e811cec44f4618b82aeb48675a5d63.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
              PID:1364
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              4⤵
                PID:2932
              • C:\Users\Admin\AppData\Local\Temp\1001698001\b016d55fa7.exe
                "C:\Users\Admin\AppData\Local\Temp\1001698001\b016d55fa7.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1620
                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4320
                  • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2980
                  • C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:844
                  • C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3628
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3016
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        8⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4936
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "wrsa opssvc"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1988
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        8⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4836
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1904
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c md 197036
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2612
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4804
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4332
                      • C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
                        Jurisdiction.pif T
                        8⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:400
                      • C:\Windows\SysWOW64\choice.exe
                        choice /d y /t 5
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2076
                  • C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4696
                  • C:\Users\Admin\AppData\Local\Temp\1000833001\3f32ecf013.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000833001\3f32ecf013.exe"
                    6⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2200
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:5588
                  • C:\Users\Admin\AppData\Local\Temp\1000857001\14ba4cb3d6.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000857001\14ba4cb3d6.exe"
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:4780
                  • C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:2396
                    • C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2768
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 1280
                        8⤵
                        • Program crash
                        PID:1672
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 264
                      7⤵
                      • Program crash
                      PID:4272
                  • C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4544
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1276
                      7⤵
                      • Program crash
                      PID:5964
                  • C:\Users\Admin\AppData\Local\Temp\1001510001\v7wa24td.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001510001\v7wa24td.exe"
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Accesses Microsoft Outlook profiles
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • outlook_office_path
                    • outlook_win_path
                    PID:4268
                    • C:\Users\Admin\AppData\Local\dp3s81isgn\tor\tor-real.exe
                      "C:\Users\Admin\AppData\Local\dp3s81isgn\tor\tor-real.exe" -f "C:\Users\Admin\AppData\Local\dp3s81isgn\tor\torrc.txt"
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:5904
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
                      7⤵
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:5688
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        8⤵
                          PID:5388
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          8⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:5356
                        • C:\Windows\system32\findstr.exe
                          findstr /R /C:"[ ]:[ ]"
                          8⤵
                            PID:5300
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
                          7⤵
                            PID:5124
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              8⤵
                                PID:5484
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show networks mode=bssid
                                8⤵
                                • Event Triggered Execution: Netsh Helper DLL
                                PID:5784
                              • C:\Windows\system32\findstr.exe
                                findstr "SSID BSSID Signal"
                                8⤵
                                  PID:5744
                            • C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:6120
                              • C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe
                                "C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe"
                                7⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5316
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 1292
                                  8⤵
                                  • Program crash
                                  PID:5424
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 264
                                7⤵
                                • Program crash
                                PID:4916
                            • C:\Users\Admin\AppData\Local\Temp\1001532001\c95b94070a.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001532001\c95b94070a.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:5696
                            • C:\Users\Admin\AppData\Local\Temp\1001533001\a05a7607dc.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001533001\a05a7607dc.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:5288
                        • C:\Users\Admin\AppData\Local\Temp\1001735001\a3133d2f80.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001735001\a3133d2f80.exe"
                          4⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4920
                        • C:\Users\Admin\AppData\Local\Temp\1001776101\a293bcd170.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001776101\a293bcd170.exe"
                          4⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2824
                        • C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
                          "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4532
                          • C:\Users\Admin\AppData\Local\Temp\is-OSHB2.tmp\FontCreator.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-OSHB2.tmp\FontCreator.tmp" /SL5="$17006C,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
                            5⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:4408
                            • C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
                              "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
                              6⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1520
                              • C:\Users\Admin\AppData\Local\Temp\is-3KCMD.tmp\FontCreator.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-3KCMD.tmp\FontCreator.tmp" /SL5="$18006C,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                PID:1824
                                • C:\Windows\system32\cmd.exe
                                  "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
                                  8⤵
                                    PID:4532
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
                                      9⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4364
                                    • C:\Windows\system32\find.exe
                                      find /I "wrsa.exe"
                                      9⤵
                                        PID:1764
                                    • C:\Windows\system32\cmd.exe
                                      "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
                                      8⤵
                                        PID:1956
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
                                          9⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4296
                                        • C:\Windows\system32\find.exe
                                          find /I "opssvc.exe"
                                          9⤵
                                            PID:3284
                                        • C:\Windows\system32\cmd.exe
                                          "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
                                          8⤵
                                            PID:4268
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
                                              9⤵
                                              • Enumerates processes with tasklist
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:540
                                            • C:\Windows\system32\find.exe
                                              find /I "avastui.exe"
                                              9⤵
                                                PID:1060
                                            • C:\Windows\system32\cmd.exe
                                              "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
                                              8⤵
                                                PID:2116
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
                                                  9⤵
                                                  • Enumerates processes with tasklist
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4124
                                                • C:\Windows\system32\find.exe
                                                  find /I "avgui.exe"
                                                  9⤵
                                                    PID:4600
                                                • C:\Windows\system32\cmd.exe
                                                  "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
                                                  8⤵
                                                    PID:1180
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
                                                      9⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2152
                                                    • C:\Windows\system32\find.exe
                                                      find /I "nswscsvc.exe"
                                                      9⤵
                                                        PID:3496
                                                    • C:\Windows\system32\cmd.exe
                                                      "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
                                                      8⤵
                                                        PID:1540
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
                                                          9⤵
                                                          • Enumerates processes with tasklist
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:848
                                                        • C:\Windows\system32\find.exe
                                                          find /I "sophoshealth.exe"
                                                          9⤵
                                                            PID:1156
                                                        • C:\Users\Admin\AppData\Local\hangbird\Updater.exe
                                                          "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
                                                          8⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3532
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\dXQfTeT.a3x && del C:\ProgramData\\dXQfTeT.a3x
                                                            9⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:6136
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping -n 5 127.0.0.1
                                                              10⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:6008
                                                            • C:\Users\Admin\AppData\Local\hangbird\Updater.exe
                                                              updater.exe C:\ProgramData\\dXQfTeT.a3x
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Checks processor information in registry
                                                              PID:1984
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                11⤵
                                                                  PID:5724
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  11⤵
                                                                    PID:5540
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                    11⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5468
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1192
                                                                      12⤵
                                                                      • Program crash
                                                                      PID:2912
                                                    • C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4736
                                                      • C:\Users\Admin\AppData\Local\Temp\is-QKIDU.tmp\FontCreator.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-QKIDU.tmp\FontCreator.tmp" /SL5="$60248,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
                                                        5⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3004
                                                        • C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:208
                                                          • C:\Users\Admin\AppData\Local\Temp\is-185AA.tmp\FontCreator.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-185AA.tmp\FontCreator.tmp" /SL5="$A0224,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:2832
                                                            • C:\Windows\system32\cmd.exe
                                                              "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
                                                              8⤵
                                                                PID:4516
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
                                                                  9⤵
                                                                  • Enumerates processes with tasklist
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1996
                                                                • C:\Windows\system32\find.exe
                                                                  find /I "wrsa.exe"
                                                                  9⤵
                                                                    PID:1176
                                                                • C:\Windows\system32\cmd.exe
                                                                  "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
                                                                  8⤵
                                                                    PID:4932
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
                                                                      9⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3380
                                                                    • C:\Windows\system32\find.exe
                                                                      find /I "opssvc.exe"
                                                                      9⤵
                                                                        PID:588
                                                                    • C:\Windows\system32\cmd.exe
                                                                      "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
                                                                      8⤵
                                                                        PID:4128
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
                                                                          9⤵
                                                                          • Enumerates processes with tasklist
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1656
                                                                        • C:\Windows\system32\find.exe
                                                                          find /I "avastui.exe"
                                                                          9⤵
                                                                            PID:5032
                                                                        • C:\Windows\system32\cmd.exe
                                                                          "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
                                                                          8⤵
                                                                            PID:4268
                                                                            • C:\Windows\system32\tasklist.exe
                                                                              tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
                                                                              9⤵
                                                                              • Enumerates processes with tasklist
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3024
                                                                            • C:\Windows\system32\find.exe
                                                                              find /I "avgui.exe"
                                                                              9⤵
                                                                                PID:4836
                                                                            • C:\Windows\system32\cmd.exe
                                                                              "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
                                                                              8⤵
                                                                                PID:4024
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
                                                                                  9⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:972
                                                                                • C:\Windows\system32\find.exe
                                                                                  find /I "nswscsvc.exe"
                                                                                  9⤵
                                                                                    PID:5048
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
                                                                                  8⤵
                                                                                    PID:464
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
                                                                                      9⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3004
                                                                                    • C:\Windows\system32\find.exe
                                                                                      find /I "sophoshealth.exe"
                                                                                      9⤵
                                                                                        PID:3496
                                                                                    • C:\Users\Admin\AppData\Local\hangbird\Updater.exe
                                                                                      "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
                                                                                      8⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2000
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\vI6kss.a3x && del C:\ProgramData\\vI6kss.a3x
                                                                                        9⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        PID:4292
                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                          ping -n 5 127.0.0.1
                                                                                          10⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          • Runs ping.exe
                                                                                          PID:2200
                                                                                        • C:\Users\Admin\AppData\Local\hangbird\Updater.exe
                                                                                          updater.exe C:\ProgramData\\vI6kss.a3x
                                                                                          10⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Checks processor information in registry
                                                                                          PID:1348
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                            11⤵
                                                                                              PID:3652
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                              11⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:212
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 1224
                                                                                                12⤵
                                                                                                • Program crash
                                                                                                PID:5504
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 1192
                                                                                                12⤵
                                                                                                • Program crash
                                                                                                PID:5008
                                                                              • C:\Users\Admin\AppData\Local\Temp\1003205001\1b3dc843b2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1003205001\1b3dc843b2.exe"
                                                                                4⤵
                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Identifies Wine through registry keys
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:216
                                                                              • C:\Users\Admin\AppData\Local\Temp\1003206001\020c27536c.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1003206001\020c27536c.exe"
                                                                                4⤵
                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Identifies Wine through registry keys
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2908
                                                                              • C:\Users\Admin\AppData\Local\Temp\1003207001\ad42b0e244.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1003207001\ad42b0e244.exe"
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:4484
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM firefox.exe /T
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3004
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM chrome.exe /T
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2292
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM msedge.exe /T
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2612
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM opera.exe /T
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3144
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /F /IM brave.exe /T
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1764
                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                  5⤵
                                                                                    PID:1792
                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                      6⤵
                                                                                      • Checks processor information in registry
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3756
                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c34fd59-33e3-41e7-95b5-4975e13cf95e} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" gpu
                                                                                        7⤵
                                                                                          PID:4580
                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2c7c809-2746-4c62-8fbf-badc053ade97} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" socket
                                                                                          7⤵
                                                                                            PID:1760
                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 1 -isForBrowser -prefsHandle 3432 -prefMapHandle 2944 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a284c12-292a-4d46-8acc-2532240c63f6} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" tab
                                                                                            7⤵
                                                                                              PID:2828
                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7857df63-e7d6-40eb-9d5f-b00998726644} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" tab
                                                                                              7⤵
                                                                                                PID:4364
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4516 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4584 -prefMapHandle 4580 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {718d79ae-0783-4b6c-8f69-8bfdaaaea29c} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" utility
                                                                                                7⤵
                                                                                                • Checks processor information in registry
                                                                                                PID:5524
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -childID 3 -isForBrowser -prefsHandle 4536 -prefMapHandle 4616 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1c209c7-3757-4e34-aacb-13b7c4f02773} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" tab
                                                                                                7⤵
                                                                                                  PID:5916
                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5588 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65529df8-7d8f-4f23-a553-704c99c377c4} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" tab
                                                                                                  7⤵
                                                                                                    PID:5928
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5768 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6426414-18d3-41ea-b295-9029e2b10331} 3756 "\\.\pipe\gecko-crash-server-pipe.3756" tab
                                                                                                    7⤵
                                                                                                      PID:5956
                                                                                              • C:\Users\Admin\AppData\Local\Temp\1003208001\num.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\1003208001\num.exe"
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2824
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2644
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:3064
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit
                                                                                            2⤵
                                                                                            • Drops startup file
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4552
                                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                          1⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5116
                                                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                          1⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:3528
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2396 -ip 2396
                                                                                          1⤵
                                                                                            PID:952
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2768 -ip 2768
                                                                                            1⤵
                                                                                              PID:2492
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4544 -ip 4544
                                                                                              1⤵
                                                                                                PID:4368
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6120 -ip 6120
                                                                                                1⤵
                                                                                                  PID:3056
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5316 -ip 5316
                                                                                                  1⤵
                                                                                                    PID:5336
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                    1⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    PID:4092
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                    1⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    PID:2704
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5468 -ip 5468
                                                                                                    1⤵
                                                                                                      PID:5756
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 212 -ip 212
                                                                                                      1⤵
                                                                                                        PID:3776
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 212 -ip 212
                                                                                                        1⤵
                                                                                                          PID:4976
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                          1⤵
                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Executes dropped EXE
                                                                                                          • Identifies Wine through registry keys
                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                          PID:3764
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                          1⤵
                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Executes dropped EXE
                                                                                                          • Identifies Wine through registry keys
                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                          PID:3968

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Persistence

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        1
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Event Triggered Execution

                                                                                                        1
                                                                                                        T1546

                                                                                                        Netsh Helper DLL

                                                                                                        1
                                                                                                        T1546.007

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Privilege Escalation

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        1
                                                                                                        T1547

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Event Triggered Execution

                                                                                                        1
                                                                                                        T1546

                                                                                                        Netsh Helper DLL

                                                                                                        1
                                                                                                        T1546.007

                                                                                                        Scheduled Task/Job

                                                                                                        1
                                                                                                        T1053

                                                                                                        Scheduled Task

                                                                                                        1
                                                                                                        T1053.005

                                                                                                        Defense Evasion

                                                                                                        Impair Defenses

                                                                                                        2
                                                                                                        T1562

                                                                                                        Disable or Modify Tools

                                                                                                        2
                                                                                                        T1562.001

                                                                                                        Modify Registry

                                                                                                        3
                                                                                                        T1112

                                                                                                        Virtualization/Sandbox Evasion

                                                                                                        2
                                                                                                        T1497

                                                                                                        Credential Access

                                                                                                        Credentials from Password Stores

                                                                                                        1
                                                                                                        T1555

                                                                                                        Credentials from Web Browsers

                                                                                                        1
                                                                                                        T1555.003

                                                                                                        Unsecured Credentials

                                                                                                        5
                                                                                                        T1552

                                                                                                        Credentials In Files

                                                                                                        4
                                                                                                        T1552.001

                                                                                                        Credentials in Registry

                                                                                                        1
                                                                                                        T1552.002

                                                                                                        Discovery

                                                                                                        Browser Information Discovery

                                                                                                        1
                                                                                                        T1217

                                                                                                        Process Discovery

                                                                                                        1
                                                                                                        T1057

                                                                                                        Query Registry

                                                                                                        7
                                                                                                        T1012

                                                                                                        Remote System Discovery

                                                                                                        1
                                                                                                        T1018

                                                                                                        System Information Discovery

                                                                                                        4
                                                                                                        T1082

                                                                                                        System Location Discovery

                                                                                                        1
                                                                                                        T1614

                                                                                                        System Language Discovery

                                                                                                        1
                                                                                                        T1614.001

                                                                                                        System Network Configuration Discovery

                                                                                                        2
                                                                                                        T1016

                                                                                                        Internet Connection Discovery

                                                                                                        1
                                                                                                        T1016.001

                                                                                                        Wi-Fi Discovery

                                                                                                        1
                                                                                                        T1016.002

                                                                                                        Virtualization/Sandbox Evasion

                                                                                                        2
                                                                                                        T1497

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Data from Local System

                                                                                                        4
                                                                                                        T1005

                                                                                                        Email Collection

                                                                                                        1
                                                                                                        T1114

                                                                                                        Command and Control

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\ProgramData\mozglue.dll
                                                                                                          Filesize

                                                                                                          593KB

                                                                                                          MD5

                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                          SHA1

                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                          SHA256

                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                          SHA512

                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                          Download Submit

                                                                                                        • C:\ProgramData\nss3.dll
                                                                                                          Filesize

                                                                                                          2.0MB

                                                                                                          MD5

                                                                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                          SHA1

                                                                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                          SHA256

                                                                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                          SHA512

                                                                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          b89ce5bb528cbbd7717c7fa07c79e413

                                                                                                          SHA1

                                                                                                          6f267d19c5e264785824c8bda90221e8f3615d1d

                                                                                                          SHA256

                                                                                                          116f3455ab73dfbebd406cda38fab03b34ef9573c9dd6d6f9b4eb56f320c289c

                                                                                                          SHA512

                                                                                                          b63692588c449e2224babd58f2df150478c84041b047a5c239d1d6cc24b883f5e21f1fd99502dfbc603dcba040214f5b05e0efdfb94307c83fc00b2831159c75

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          f8869f8eb4fa627439538cda569f904e

                                                                                                          SHA1

                                                                                                          07da66fcaab196c7421b909e76f423de56673a76

                                                                                                          SHA256

                                                                                                          7f0e6d29d8b5dce9f22277321ce3ff27ffc9520f37275b3068fc835291b73d71

                                                                                                          SHA512

                                                                                                          9e46d7ae5a4734d4422a8c8b78925d6053fba3b79552c2efd1c8d3b24806424c3dee98871f8129f0bd7284f648b95b69bae97479fb2c47d41ed5fce007ff4e33

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                                          Filesize

                                                                                                          307KB

                                                                                                          MD5

                                                                                                          68a99cf42959dc6406af26e91d39f523

                                                                                                          SHA1

                                                                                                          f11db933a83400136dc992820f485e0b73f1b933

                                                                                                          SHA256

                                                                                                          c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                                                                                                          SHA512

                                                                                                          7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe
                                                                                                          Filesize

                                                                                                          6.8MB

                                                                                                          MD5

                                                                                                          87e4e869971cec9573811040f6140157

                                                                                                          SHA1

                                                                                                          6308d9e243317a829d602c6a2f667fff6d05d148

                                                                                                          SHA256

                                                                                                          0ad7e833d526131900916008913dec998360ee6d1a9aacf3997602e1cfc1c3e3

                                                                                                          SHA512

                                                                                                          71f1040d823deb28361966e41f0cba63d735425edc83c9d790b1bffc2abe97eb5fe2642358b0aa3b9a505230d87049c0d36f84e58499575d2d5983926df0e881

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          MD5

                                                                                                          5d97c2475c8a4d52e140ef4650d1028b

                                                                                                          SHA1

                                                                                                          da20d0a43d6f8db44ff8212875a7e0f7bb223223

                                                                                                          SHA256

                                                                                                          f34dd7ec6030b1879d60faa8705fa1668adc210ddd52bcb2b0c2406606c5bccf

                                                                                                          SHA512

                                                                                                          22c684b21d0a9eb2eaa47329832e8ee64b003cfb3a9a5d8b719445a8532b18aad913f84025a27c95296ebeb34920fa62d64f28145ccfa3aa7d82ba95381924ee

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe
                                                                                                          Filesize

                                                                                                          5.7MB

                                                                                                          MD5

                                                                                                          5009b1ef6619eca039925510d4fd51a1

                                                                                                          SHA1

                                                                                                          22626aa57e21291a995615f9f6bba083d8706764

                                                                                                          SHA256

                                                                                                          fbc8c32bf799a005c57540a2e85dd3662ed5795a55f11495f0ba569bbb09df59

                                                                                                          SHA512

                                                                                                          2b5bbd9449be00588058966db487c0adfac764827a6691f6a9fc6c3a770a93bda11c732d2eb2a3c660697cbc69b1c71a2bf76d2957f65cd2599fb28098b24f14

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000833001\3f32ecf013.exe
                                                                                                          Filesize

                                                                                                          514KB

                                                                                                          MD5

                                                                                                          26d8d52bac8f4615861f39e118efa28d

                                                                                                          SHA1

                                                                                                          efd5a7ccd128ffe280af75ec8b3e465c989d9e35

                                                                                                          SHA256

                                                                                                          8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f

                                                                                                          SHA512

                                                                                                          1911a21d654e317fba50308007bb9d56fba2c19a545ef6dfaade17821b0f8fc48aa041c8a4a0339bee61cbd429852d561985e27c574eced716b2e937afa18733

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000857001\14ba4cb3d6.exe
                                                                                                          Filesize

                                                                                                          2.8MB

                                                                                                          MD5

                                                                                                          f1beef5bbdf2a5595492cf9c608cb1a5

                                                                                                          SHA1

                                                                                                          eb9428e194b14e74939b6fb5c6a7ff4ac47f276e

                                                                                                          SHA256

                                                                                                          8d5abdc31f52e58190a7fd65ee4ce293d71def97a08c346036731523120a1241

                                                                                                          SHA512

                                                                                                          c01916ee1378ba992d16e7663b4ca061d99cae11189b2d06a52fc9c01be84c6086fb99e1b50841fd0c77fd248cd7c9bd3223b2bb73e1aa15b049bbab856d9fc6

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
                                                                                                          Filesize

                                                                                                          645KB

                                                                                                          MD5

                                                                                                          bdf3c509a0751d1697ba1b1b294fd579

                                                                                                          SHA1

                                                                                                          3a3457e5a8b41ed6f42b3197cff53c8ec50b4db2

                                                                                                          SHA256

                                                                                                          d3948ae31c42fcba5d9199e758d145ff74dad978c80179afb3148604c254be6d

                                                                                                          SHA512

                                                                                                          aa81ccbae9f622531003f1737d22872ae909b28359dfb94813a39d74bde757141d7543681793102a1dc3dcaecea27cffd0363de8bbb48434fcf8b6dafef320b3

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe
                                                                                                          Filesize

                                                                                                          327KB

                                                                                                          MD5

                                                                                                          fba8f56206955304b2a6207d9f5e8032

                                                                                                          SHA1

                                                                                                          f84cbcc3e34f4d2c8fea97c2562f937e1e20fe28

                                                                                                          SHA256

                                                                                                          11227ead147b4154c7bd21b75d7f130b498c9ad9b520ca1814c5d6a688c89b1b

                                                                                                          SHA512

                                                                                                          56e3a0823a7abe08e1c9918d8fa32c574208b462b423ab6bde03345c654b75785fdc3180580c0d55280644b3a9574983e925f2125c2d340cf5e96b98237e99fa

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001172001\Set-up.exe
                                                                                                          Filesize

                                                                                                          36B

                                                                                                          MD5

                                                                                                          a1ca4bebcd03fafbe2b06a46a694e29a

                                                                                                          SHA1

                                                                                                          ffc88125007c23ff6711147a12f9bba9c3d197ed

                                                                                                          SHA256

                                                                                                          c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65

                                                                                                          SHA512

                                                                                                          6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001510001\v7wa24td.exe
                                                                                                          Filesize

                                                                                                          772KB

                                                                                                          MD5

                                                                                                          6782ce61039f27f01fb614d3069c7cd0

                                                                                                          SHA1

                                                                                                          6870c4d274654f7a6d0971579b50dd9dedaa18ad

                                                                                                          SHA256

                                                                                                          11798c5a66618d32e2666009fb1f4569ae8b2744fa0278f915f5c1eefb1fd98d

                                                                                                          SHA512

                                                                                                          90fc316784eba2e553c2658ac348e6fcb4ab6987209d51e83c1d39d7a784ca0f18729349904bac6d92d3b163ce9f0270369a38eac8c9541ae211d74bce794938

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe
                                                                                                          Filesize

                                                                                                          731KB

                                                                                                          MD5

                                                                                                          98d80ccce4381776207b8a09f7cf0c11

                                                                                                          SHA1

                                                                                                          d5d98427cfd1108ceb60354f5d2bbb0c564eda93

                                                                                                          SHA256

                                                                                                          963a20f6631013a1c9b0f17a3d15ed9546dae5b5f347789dbde36d02a51ee3de

                                                                                                          SHA512

                                                                                                          ee6ab1686b48565a10bed17451d37273234f6c55c2e2b990521547453a09d27574077a7c88f9750d83dd9b6b51c109248f67b3d4c0f662ed9c9a63806f02d1ee

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001698001\b016d55fa7.exe
                                                                                                          Filesize

                                                                                                          1.8MB

                                                                                                          MD5

                                                                                                          b05a48ffede13e40451d9702d6dba6fa

                                                                                                          SHA1

                                                                                                          6edf45709bda64c19399ba40c6c68f19acd395b2

                                                                                                          SHA256

                                                                                                          98ac9153af5926fdc760539498497dbfa1dd2ff00b89fed3a70a2382167acc83

                                                                                                          SHA512

                                                                                                          e745cf0f7ca89a028778b3c7efc90b30ff87655a8edb3aeefb2b64e3eeefea85fccc72804a23b1dd50f48dbec8955a62d43fd2592d48d9d02ab50eae14aef506

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001735001\a3133d2f80.exe
                                                                                                          Filesize

                                                                                                          2.6MB

                                                                                                          MD5

                                                                                                          5ab132cf0b7c282f2da225f5c60a9ec7

                                                                                                          SHA1

                                                                                                          21dd63a771ea5711ba3583956c16b4f6f6a0d6f7

                                                                                                          SHA256

                                                                                                          e11298a93c7cb5324223122640ed398e8b2ceabc089032d1dbbc1d3e6a94e79a

                                                                                                          SHA512

                                                                                                          4127f0416c3c87c21c423aec5eee003edcf5ed467d14e916fa15cf7fcc9c56831510be55c8f6bc99c9c672da83dce60e10cf3138e33fe184ce67c457ddbec361

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
                                                                                                          Filesize

                                                                                                          5.9MB

                                                                                                          MD5

                                                                                                          6fdf2cdf68ab1880aa76e7938e241fa3

                                                                                                          SHA1

                                                                                                          affc9a0aea771ad101357cc728951f5938b5e4e6

                                                                                                          SHA256

                                                                                                          e61ce90df13402909985f5312fdef798736eb10e0b5b6b280fb826538e7a597a

                                                                                                          SHA512

                                                                                                          7e649db70d39a135cd86a837308fb304f16c904456ca3b97a70b8f8b1fd617291de8974aab3808ac67e5d2f7e9efa3840bbdeba1e3558de33587c7ff94ce231d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1003205001\1b3dc843b2.exe
                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          MD5

                                                                                                          cb7fa6dad5ddc51dccc15676d7982d3c

                                                                                                          SHA1

                                                                                                          d45d2b10fce11e3bfa80ac520b8ed9dbb80a84be

                                                                                                          SHA256

                                                                                                          bda6f57d1ce3d9e4dfe306043bc49bc18afaa2d69bb69846c19317d737e432a5

                                                                                                          SHA512

                                                                                                          976a02d76654c1b196cae5a5f9ea37568f2b444e3bf7fd00fe789b4488adae9fa14dc561fdafc3b9eb97e42873cc6f19d6e0a3e97ddf64a7e9e7f6d588ff3271

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1003206001\020c27536c.exe
                                                                                                          Filesize

                                                                                                          2.0MB

                                                                                                          MD5

                                                                                                          a2431d54319af7b5c1f2d228e7bcbf3e

                                                                                                          SHA1

                                                                                                          79063fe221c894f45520555a7063b4c53013c2fb

                                                                                                          SHA256

                                                                                                          1addb3abb80452598f0c5eac63d6424a4b73337c2a44f2b0ab2e82e9917e3a9a

                                                                                                          SHA512

                                                                                                          79bf2cba78a986b8b795708a7f6664b88c9ddefac110d083065d170494b56768d006c82f1063f062442a4b74502802f1ba630c0f29f61e9ec58c5d450fc879b6

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1003207001\ad42b0e244.exe
                                                                                                          Filesize

                                                                                                          898KB

                                                                                                          MD5

                                                                                                          931f93466b9d9c7d6cd3979bb981de38

                                                                                                          SHA1

                                                                                                          58c1373f91df45e01d89bff790dc6982a9434e19

                                                                                                          SHA256

                                                                                                          e4382e61bb61863bb13058748f930ceea95a3a611fe94bdf997b176debdf90d0

                                                                                                          SHA512

                                                                                                          d93dc93d183f77744376dadc100b2433114a1ab58e2d22614bc62d16542391b2769ef5bca214f9a7383ee859def5e64eebf5cea2cee8628671b6756632e6a663

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1003208001\num.exe
                                                                                                          Filesize

                                                                                                          868KB

                                                                                                          MD5

                                                                                                          f793d9e588c6bf51f1daf523ab2df1ce

                                                                                                          SHA1

                                                                                                          f63ce1f9eee9f3ae643e270c7fc854dc51d730d0

                                                                                                          SHA256

                                                                                                          a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d

                                                                                                          SHA512

                                                                                                          4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
                                                                                                          Filesize

                                                                                                          872KB

                                                                                                          MD5

                                                                                                          18ce19b57f43ce0a5af149c96aecc685

                                                                                                          SHA1

                                                                                                          1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                                                                                          SHA256

                                                                                                          d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                                                                                          SHA512

                                                                                                          a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\197036\T
                                                                                                          Filesize

                                                                                                          580KB

                                                                                                          MD5

                                                                                                          4b0812fabc1ba34d8d45d28180f6c75f

                                                                                                          SHA1

                                                                                                          b9d99c00a6f9d5f23e244cc0555f82a7d0eeb950

                                                                                                          SHA256

                                                                                                          73312c3ea63faf89e2067e034a9148bf73efb5140c1ba6a67aaf62170ee98103

                                                                                                          SHA512

                                                                                                          7f72ffd39f7b66ea701ec642a427c90f9c3ee9be69a3e431c492be76ae9a73e8b2b1fbb16553a5a6d8722baf30b2a392a47c7c998d618459bf398d47d218d158

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\350944739639
                                                                                                          Filesize

                                                                                                          96KB

                                                                                                          MD5

                                                                                                          a8991c4387f8cbafe6979b1155ddf833

                                                                                                          SHA1

                                                                                                          698f50cff86972759b5b1b9b7f3c4f4f39c2c9c8

                                                                                                          SHA256

                                                                                                          cabfe360ff2f121f166bfd31510fe01a19bddb74e8e3b0596588171032c40956

                                                                                                          SHA512

                                                                                                          4f35aa77c9c89d91311dbc369cc372d22b253a3f2e23373b675f959d9435c0930a23c1f9f865505ec86ea5b5b964614371faad181ec287e4c20067e5739b99f5

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Beijing
                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          2a84a77ad125a30e442d57c63c18e00e

                                                                                                          SHA1

                                                                                                          68567ee0d279087a12374c10a8b7981f401b20b8

                                                                                                          SHA256

                                                                                                          0c6ead18e99077a5dde401987a0674b156c07ccf9b7796768df8e881923e1769

                                                                                                          SHA512

                                                                                                          9d6a720f970f8d24ed4c74bed25c5e21c90191930b0cc7e310c8dd45f6ed7a0b3d9b3abbd8f0b4979f992c90630d215b1852b3242c5d0a6e7a42ecef03c0076a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Fitting
                                                                                                          Filesize

                                                                                                          62KB

                                                                                                          MD5

                                                                                                          46a51002cdbe912d860ce08c83c0376b

                                                                                                          SHA1

                                                                                                          6d0ae63850bd8d5c86e45cba938609a7f051f59b

                                                                                                          SHA256

                                                                                                          18070c4700df6609e096f2e79f353844e3e98c9aacca69919a8baeb9f9890017

                                                                                                          SHA512

                                                                                                          ed7c8d09e305687dc687ab23f6a83692232677c120836c8f4b876c4dfa867b47e29684e7e1c7973f6c29eeed1b8530b96f609a6111dde36d94f6657c9b5a4e44

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Molecular
                                                                                                          Filesize

                                                                                                          69KB

                                                                                                          MD5

                                                                                                          8ca4bbb4e4ddf045ff547cb2d438615c

                                                                                                          SHA1

                                                                                                          3e2fc0fdc0359a08c7782f44a5ccebf3a52b5152

                                                                                                          SHA256

                                                                                                          4e4bb4aa1f996e96db8e18e4f2a6576673c00b76126f846ba821b4cd3998afed

                                                                                                          SHA512

                                                                                                          b45ed05fa6d846c0a38cefcd5d256fdee997b9010bc249a34d830953100ca779ab88547353cc8badaf2908f59ff3a8c780f7cac189c0f549246feb504ecb5af9

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Mtv
                                                                                                          Filesize

                                                                                                          7KB

                                                                                                          MD5

                                                                                                          f3d7abb7a7c91203886dd0f2df4fc0d6

                                                                                                          SHA1

                                                                                                          60ffbb095fceeb2ea2b9e65355e9dbf1de736d6c

                                                                                                          SHA256

                                                                                                          5867350b8ad8bb5d83111aed8b296b8c28328ba72b5bedb0cbeb99b3dc600cb3

                                                                                                          SHA512

                                                                                                          9af80787c63fa7de9a22eea3d1f13d25ff1558ed95321a8178da734dce5126f0b7322f13cddd40c1bc67b65140f684a190dd117247f06600a07db97b015aa367

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\See
                                                                                                          Filesize

                                                                                                          58KB

                                                                                                          MD5

                                                                                                          84c831b7996dfc78c7e4902ad97e8179

                                                                                                          SHA1

                                                                                                          739c580a19561b6cde4432a002a502bea9f32754

                                                                                                          SHA256

                                                                                                          1ac7db51182a2fc38e7831a67d3ff4e08911e4fca81a9f2aa0b7c7e393cc2575

                                                                                                          SHA512

                                                                                                          ae8e53499535938352660db161c768482438f5f6f5afb632ce7ae2e28d9c547fcf4ed939dd136e17c05ed14711368bdd6f3d4ae2e3f0d78a21790b0955745991

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Spirit
                                                                                                          Filesize

                                                                                                          80KB

                                                                                                          MD5

                                                                                                          0814e2558c8e63169d393fac20c668f9

                                                                                                          SHA1

                                                                                                          52e8b77554cc098410408668e3d4f127fa02d8bd

                                                                                                          SHA256

                                                                                                          cfdc18b19fe2c0f099fd9f733fe4494aa25b2828d735c226d06c654694fcf96d

                                                                                                          SHA512

                                                                                                          80e70a6eb57df698fe85d4599645c71678a76340380d880e108b391c922adadf42721df5aa994fcfb293ab90e7b04ff3d595736354b93fcb6b5111e90b475319

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Sponsorship
                                                                                                          Filesize

                                                                                                          71KB

                                                                                                          MD5

                                                                                                          6785e2e985143a33c5c3557788f12a2b

                                                                                                          SHA1

                                                                                                          7a86e94bc7bc10bd8dd54ade696e10a0ae5b4bf0

                                                                                                          SHA256

                                                                                                          66bbe1741f98dbb750aa82a19bc7b5dc1cdbecf31f0d9ddb03ff7cf489f318c7

                                                                                                          SHA512

                                                                                                          3edad611d150c99dbb24a169967cc31e1d3942c3f77b3af2de621a6912356400c8003b1c99a7236b6bed65bd136d683414e96c698eabd33d66d7ab231cdfee91

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Sweet
                                                                                                          Filesize

                                                                                                          865KB

                                                                                                          MD5

                                                                                                          6cee6bd1b0b8230a1c792a0e8f72f7eb

                                                                                                          SHA1

                                                                                                          66a7d26ed56924f31e681c1af47d6978d1d6e4e8

                                                                                                          SHA256

                                                                                                          08ac328ad30dfc0715f8692b9290d7ac55ce93755c9aca17f1b787b6e96667ab

                                                                                                          SHA512

                                                                                                          4d78417accf1378194e4f58d552a1ea324747bdec41b3c59a6784ee767f863853eebafe2f2bc6315549bddc4d7dc7ce42c42ff7f383b96ae400cac8cf4c64193

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Twisted
                                                                                                          Filesize

                                                                                                          95KB

                                                                                                          MD5

                                                                                                          ba8c4239470d59c50a35a25b7950187f

                                                                                                          SHA1

                                                                                                          855a8f85182dd03f79787147b73ae5ed61fb8d7b

                                                                                                          SHA256

                                                                                                          a6272116dc959a3197a969923f85c000a1388b0a02df633dec59b7273bdb421b

                                                                                                          SHA512

                                                                                                          1e6d42c249d206815000cc85d5216d13729246e114647d8ccf174b9bd679530b6b39dfab2bfcc5d957cc0778a8cf029e544228978682fa285c5e3f9564c2eaf0

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Various
                                                                                                          Filesize

                                                                                                          92KB

                                                                                                          MD5

                                                                                                          2759c67bccd900a1689d627f38f0a635

                                                                                                          SHA1

                                                                                                          d71b170715ed2b304167545af2bd42834ccf1881

                                                                                                          SHA256

                                                                                                          510cfd9523a0f8462e8cbdcbbf1afccf2aa69a9153472ee48fd28ad4fe06ca05

                                                                                                          SHA512

                                                                                                          aa9e26ad8824ed2ca8bf45c24939e305660cbc19f821a84a7407a16f91d71b2eb9daba9059d379908f17c9e5a17c0c3e873e5cd7350ee8715e45b2b3eff2531e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Witch
                                                                                                          Filesize

                                                                                                          53KB

                                                                                                          MD5

                                                                                                          79156afddd310be36f037a8f0708a794

                                                                                                          SHA1

                                                                                                          09ef36ae22b5eab65d1f62166542601b8919399d

                                                                                                          SHA256

                                                                                                          7faaf10d09a27842330725e6510d2754487c5b69bd40e11181dd75b03df61503

                                                                                                          SHA512

                                                                                                          d1449126f2365f607a390e3b6fecb3be100bff9fae1a773cf5815cab29eeb72ab4e341022bde9de653fd62ede0fb0c26d9010e524d87060aa364bf92a14e9d01

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                          Filesize

                                                                                                          1.8MB

                                                                                                          MD5

                                                                                                          e4a532ee93f6f2a27f3ee4b409b381a2

                                                                                                          SHA1

                                                                                                          2e25dc2c0f3fbcb3822aa475da9e028e0886ff78

                                                                                                          SHA256

                                                                                                          fecfcafbc51111738d330ff9d41e8f2776e811cec44f4618b82aeb48675a5d63

                                                                                                          SHA512

                                                                                                          f3cf34504f68596e5f443ff0f3267d39eb90001548cf58e4feadee90bf3eda2014ecbc49c9510af187c4c38a271934c9d2d83d33c38c51419d4c09d6dafccfbe

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-27B54.tmp\_isetup\_isdecmp.dll
                                                                                                          Filesize

                                                                                                          28KB

                                                                                                          MD5

                                                                                                          077cb4461a2767383b317eb0c50f5f13

                                                                                                          SHA1

                                                                                                          584e64f1d162398b7f377ce55a6b5740379c4282

                                                                                                          SHA256

                                                                                                          8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

                                                                                                          SHA512

                                                                                                          b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-OSHB2.tmp\FontCreator.tmp
                                                                                                          Filesize

                                                                                                          3.2MB

                                                                                                          MD5

                                                                                                          945ec37b9971c5e9f26fafad6edfd46e

                                                                                                          SHA1

                                                                                                          35aeeedfab069194aa41f64df0e96780c30837b4

                                                                                                          SHA256

                                                                                                          c2e55aa7241dde41ed9690bd369e62a49d78ad2662c500509ff88ff8342a487f

                                                                                                          SHA512

                                                                                                          283f3e98def0b0f249c5b7cb1d6c0deb6fe922d3d4a68edf180e791a96f7c18c678e7b4848b5fb03b6c25038be9850b815b426674a93ea410c430cb261a3f226

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                          Filesize

                                                                                                          479KB

                                                                                                          MD5

                                                                                                          09372174e83dbbf696ee732fd2e875bb

                                                                                                          SHA1

                                                                                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                          SHA256

                                                                                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                          SHA512

                                                                                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                                          Filesize

                                                                                                          13.8MB

                                                                                                          MD5

                                                                                                          0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                          SHA1

                                                                                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                          SHA256

                                                                                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                          SHA512

                                                                                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\dp3s81isgn\tor\data\cached-microdesc-consensus.tmp
                                                                                                          Filesize

                                                                                                          2.8MB

                                                                                                          MD5

                                                                                                          848a22b18a8b00d365ae36a2c2f2a03c

                                                                                                          SHA1

                                                                                                          0ebd8410061cb56329a94b247a5a18cbe273c798

                                                                                                          SHA256

                                                                                                          3e5c062d839bd26472a205486f7422282579bf6d074a3a393125e982ede029df

                                                                                                          SHA512

                                                                                                          9b5d53227054c51ec65940d194e4d1341ee3fdf1ebab6cb722163e308a806ba8290a686871889da5918596b3433b197a85d2fb927939b308bea96cf879847c5f

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\dp3s81isgn\tor\data\cached-microdescs.new
                                                                                                          Filesize

                                                                                                          8.8MB

                                                                                                          MD5

                                                                                                          51ce79a104c0781456b2f94cc4f05239

                                                                                                          SHA1

                                                                                                          ef45890a090e262fdb742d4efcccfcc407972c45

                                                                                                          SHA256

                                                                                                          9906c8a3064adb42777295d1cd5940d3cf0b3751b599fe7c092bccc2706716a3

                                                                                                          SHA512

                                                                                                          85a91741737c26eba0d5f0a543a7b288c0fa1d158c12a5dc4be07b8c53c8c9e8d0c164a66e3045c05daab97d6db8d602903afbb26aefe6d425a1f740b191ea5b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\dp3s81isgn\tor\tor-real.exe
                                                                                                          Filesize

                                                                                                          4.0MB

                                                                                                          MD5

                                                                                                          07244a2c002ffdf1986b454429eace0b

                                                                                                          SHA1

                                                                                                          d7cd121caac2f5989aa68a052f638f82d4566328

                                                                                                          SHA256

                                                                                                          e9522e6912a0124c0a8c9ff9bb3712b474971376a4eb4ca614bb1664a2b4abcf

                                                                                                          SHA512

                                                                                                          4a09db85202723a73703c5926921fef60c3dddae21528a01936987306c5e7937463f94a2f4a922811de1f76621def2a8a597a8b38a719dd24e6ff3d4e07492ca

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\hangbird\Updater.exe
                                                                                                          Filesize

                                                                                                          921KB

                                                                                                          MD5

                                                                                                          3f58a517f1f4796225137e7659ad2adb

                                                                                                          SHA1

                                                                                                          e264ba0e9987b0ad0812e5dd4dd3075531cfe269

                                                                                                          SHA256

                                                                                                          1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

                                                                                                          SHA512

                                                                                                          acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\hangbird\caliculus.csv
                                                                                                          Filesize

                                                                                                          61KB

                                                                                                          MD5

                                                                                                          025c4f4147cdf2a529aba92b249a86aa

                                                                                                          SHA1

                                                                                                          a83259f31f6e78acb9f01eb5880c72dd9ce435e7

                                                                                                          SHA256

                                                                                                          5620e7c13f5c8b19c02fb1c1c27eceeb88fea23598411704563c3129093b862d

                                                                                                          SHA512

                                                                                                          6a2f4443700e0ab26247c923287ac2a78cbb032457398951877f75d1cdfbcc1f417833d083dccc37e2d772b0dc36cda3e71ec41f0ddc451aecc6bafc15157419

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\hangbird\caliculus.zip
                                                                                                          Filesize

                                                                                                          498KB

                                                                                                          MD5

                                                                                                          bd2302f160b9895dd7bcf9c7dfa9bea7

                                                                                                          SHA1

                                                                                                          8fcb264280a30cc5f959d54ae75ae394054ca5a0

                                                                                                          SHA256

                                                                                                          3eaff063360a89395b52681248a64aa2a8acca6da13eaa0194db004fa2a612c0

                                                                                                          SHA512

                                                                                                          2847c9e4233a5f5a662027d46ee04eb4d79ad937fbdddc54b16e72547e34414094ff56bc08016fcf31ba5769cfca2d7849ad3edea438c57b34402f1e105852e6

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          e11c71b51ef06af753adca8e7e3d8249

                                                                                                          SHA1

                                                                                                          091143ad923ed28441cb3691d19339b27faa12c4

                                                                                                          SHA256

                                                                                                          e94140b408d18a9e6a79b3642656e8b1944df890c6da0e2268d592fa57bb9258

                                                                                                          SHA512

                                                                                                          4e38eed597df4bfd1d6798c677937a4c11e81b5e43ad2561ca7b8e27652c8311025f6c287ea6ab2bb25bf2b4f58c0a25830f8a1eae6508cbca5268d4655e92bd

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                          Filesize

                                                                                                          15KB

                                                                                                          MD5

                                                                                                          2c5629f3558b64f58f106c36587b12b8

                                                                                                          SHA1

                                                                                                          70bd68a565ed33d427d85c9a6762811961af978a

                                                                                                          SHA256

                                                                                                          60363b3b638141438bd7de5ac7ff0238df6c5352b6df96f7824e9c2a65f542b3

                                                                                                          SHA512

                                                                                                          b4e12f4c813b329395fd893c4a63101c014155dbf51e59bc135605035d874428d82799b4e47b7742a4b2f308690dc3d9332ba885c95577d5768767d8b0930593

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                          Filesize

                                                                                                          14KB

                                                                                                          MD5

                                                                                                          6a77f16e5a89a8655330a707234e8279

                                                                                                          SHA1

                                                                                                          c8b308072b58fd726732b164c6f812b2e3ff34b3

                                                                                                          SHA256

                                                                                                          ebf4879437ff373afd68225d0ee2e280c743ef0eca356ed8eb993ef1eb35ee1a

                                                                                                          SHA512

                                                                                                          684414303eb67c0f5d938e626461f90c6ac73fdfe4287ead214600eb2567c31f28ecbbfdf4a49a47a6118ed7f7fce8585bca2080cdc0c0face97c76d5dccbee2

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          eb847f7a964185d576e11f78bca412a2

                                                                                                          SHA1

                                                                                                          4860ee38c16910fd1b7415763aa0ab071a283f46

                                                                                                          SHA256

                                                                                                          3580dbe4f181f4b081937e3ffa9c313ca8642d3d439fe9d8d977164df2455e81

                                                                                                          SHA512

                                                                                                          2f97b646b9af37c215359bd348dd24867a0d3f91b6b6e9601773b3344e0f50b0df3ffeee4ecc03c49b167a4b0cd09e57e883019fb0bfaa22718ea7cc27b900f7

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\0526d462-a9f8-4c8c-8491-574ecc79394c
                                                                                                          Filesize

                                                                                                          671B

                                                                                                          MD5

                                                                                                          7b24116a98135da54c7b5ed4f1aa6c9b

                                                                                                          SHA1

                                                                                                          e473c45a5bda664fba44138abaef49fadb735a79

                                                                                                          SHA256

                                                                                                          bf98486326821b2403ad03ac4f5e2c31100f3ae5ad7a8bb9b87db02227734341

                                                                                                          SHA512

                                                                                                          74b9a9d6268cc2d522a4017ef915d257be6841981f196f84064a235d6bbd78e939d3b02e40ed2bf3b8665a0b59b4018d24f95530fd1a53688e173501367eef14

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\4d1b3a97-e266-44f4-a772-d888f744dd87
                                                                                                          Filesize

                                                                                                          25KB

                                                                                                          MD5

                                                                                                          6a4d77ae6fb050ae451780ab49b1f0c7

                                                                                                          SHA1

                                                                                                          f9a3d1658849ef9f863f2f64564e9f631db0f8e8

                                                                                                          SHA256

                                                                                                          5a4033e21fa255b63b347f2867855282b6aeb48846547212e3f5176e3f9cb3fd

                                                                                                          SHA512

                                                                                                          3da887b91b46ce6cdb8ebdc5d16985d5a2e5af26888af864008b1cc073891dbe397ab759fe78940d33c5985c93849f2aa82254bde784dc5d3b5da16082052e7c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\b5da85e8-2f1c-40c3-a3e3-b2b4c1103de4
                                                                                                          Filesize

                                                                                                          982B

                                                                                                          MD5

                                                                                                          eb254d194ccd2c0b2116e73961c57e74

                                                                                                          SHA1

                                                                                                          129de1805e5c640c153d764460cd3d31f6dc9c92

                                                                                                          SHA256

                                                                                                          48825f33cb2ac4e0e8f66da7f8383218d34fb31864336c50f336c1aaa016c733

                                                                                                          SHA512

                                                                                                          4cb380f9424ed19d25eccb0315eab3e274a9ae4a9453b7b3dba6cb545ac9c6035b6eb02b20c92bbba39c6043cdc6f17c965944cc88024f7c3e1af93b4bfc8775

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          842039753bf41fa5e11b3a1383061a87

                                                                                                          SHA1

                                                                                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                          SHA256

                                                                                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                          SHA512

                                                                                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                                                          Filesize

                                                                                                          116B

                                                                                                          MD5

                                                                                                          2a461e9eb87fd1955cea740a3444ee7a

                                                                                                          SHA1

                                                                                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                          SHA256

                                                                                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                          SHA512

                                                                                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                                                                          Filesize

                                                                                                          372B

                                                                                                          MD5

                                                                                                          bf957ad58b55f64219ab3f793e374316

                                                                                                          SHA1

                                                                                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                          SHA256

                                                                                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                          SHA512

                                                                                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                                                                          Filesize

                                                                                                          17.8MB

                                                                                                          MD5

                                                                                                          daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                          SHA1

                                                                                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                          SHA256

                                                                                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                          SHA512

                                                                                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          25bb087af68ee400c72016017c134fbb

                                                                                                          SHA1

                                                                                                          313baeca6ad7ea3a6852cc45d2a449208e9a6acf

                                                                                                          SHA256

                                                                                                          d5ea4d494249f5ee08b5f91954c7de52048d97a5b45a87af1bac6f7f1ec88968

                                                                                                          SHA512

                                                                                                          30b8acbf42d8376ed07ae143385d71bcb7825c99d2ad939fae8449f60edbaaee23144c2b9b7dcce6ce317a25675d7b12aa546ba359a3cf428ac589913566ffb5

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                                                                                          Filesize

                                                                                                          16KB

                                                                                                          MD5

                                                                                                          cb0bfd286ee4d9242dd4b55c330beb9f

                                                                                                          SHA1

                                                                                                          a47f1f11c894aac59015e16c50c47642a703c316

                                                                                                          SHA256

                                                                                                          24114e9063609158aaf3610207111b153e956200c6dbc8dc83258537a4e67a99

                                                                                                          SHA512

                                                                                                          f7a1deeb7cec1321c75efb4e82691ae23ba906c22a31f265982547e88c0222896d1f4cf8747b7f9c3fbf20f8961d5977ed3b18e9184f0bad222b8838e1caa4b1

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          b5dc3ffa301207c941f4f8fdc778fd38

                                                                                                          SHA1

                                                                                                          26ed8d4e55b4ff13825dbf2e7b2f4296ccd44a6c

                                                                                                          SHA256

                                                                                                          4ef045f0616a66e07aeca162620eaf7a4436be90a0b8ca4700d83e0a2660d768

                                                                                                          SHA512

                                                                                                          0822deba148f91d8920b74b183a9300172208129731a2964eecd56aa385675c98d43a8c7941898f616482f57c9c5f6876dad8cc4ef6f25bdac752867f7615b47

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          1765943137b885614bd2b838dca27158

                                                                                                          SHA1

                                                                                                          72c4afe2cdee6ae53aae6805bdeb32cf20c6f356

                                                                                                          SHA256

                                                                                                          5f729296596d60a2788751487519b3e4307742fc38dfb4b843f7a0d4500ffe17

                                                                                                          SHA512

                                                                                                          0ce318bbe2ffeb751cfc8cf35d05e15bcdbb8674a7d0749011a4c9261c9f4a7d12008cd33dd7e9a7e79220c140ce947ae2ddb4ef91f3de3275a58ce979977ad3

                                                                                                          Download Submit

                                                                                                        • memory/208-1033-0x0000000000250000-0x000000000032C000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/208-901-0x0000000000250000-0x000000000032C000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/216-1003-0x0000000000380000-0x000000000066C000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/216-1034-0x0000000000380000-0x000000000066C000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/844-167-0x00000000009F0000-0x00000000010C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.8MB

                                                                                                          Download

                                                                                                        • memory/1520-833-0x0000000000CE0000-0x0000000000DBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/1520-1018-0x0000000000CE0000-0x0000000000DBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/1620-56-0x00000000009D0000-0x0000000000E93000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/1620-43-0x00000000009D0000-0x0000000000E93000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/1824-1016-0x0000000000B20000-0x0000000000E63000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/2200-986-0x0000000000B40000-0x0000000000BC6000-memory.dmp

                                                                                                          Filesize

                                                                                                          536KB

                                                                                                          Download

                                                                                                        • memory/2200-987-0x000000001C960000-0x000000001C9E2000-memory.dmp

                                                                                                          Filesize

                                                                                                          520KB

                                                                                                          Download

                                                                                                        • memory/2704-2244-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/2704-2206-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/2764-0-0x0000000000E50000-0x00000000012F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/2764-17-0x0000000000E50000-0x00000000012F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/2764-4-0x0000000000E50000-0x00000000012F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/2764-3-0x0000000000E50000-0x00000000012F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/2764-2-0x0000000000E51000-0x0000000000E7F000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                          Download

                                                                                                        • memory/2764-1-0x0000000077494000-0x0000000077496000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                          Download

                                                                                                        • memory/2768-1116-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/2768-1115-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/2824-154-0x0000000000A60000-0x0000000000D0E000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/2824-799-0x0000000000A60000-0x0000000000D0E000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/2824-1159-0x00000000002A0000-0x000000000058D000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/2824-754-0x0000000000A60000-0x0000000000D0E000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/2824-1364-0x00000000002A0000-0x000000000058D000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/2824-120-0x0000000000A60000-0x0000000000D0E000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/2824-155-0x0000000000A60000-0x0000000000D0E000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/2832-1031-0x0000000000B10000-0x0000000000E53000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/2908-1064-0x0000000000580000-0x0000000000CAF000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.2MB

                                                                                                          Download

                                                                                                        • memory/2908-1049-0x0000000000580000-0x0000000000CAF000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.2MB

                                                                                                          Download

                                                                                                        • memory/2980-136-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                          Filesize

                                                                                                          972KB

                                                                                                          Download

                                                                                                        • memory/2980-815-0x0000000000F50000-0x00000000011B1000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.4MB

                                                                                                          Download

                                                                                                        • memory/2980-73-0x0000000000F50000-0x00000000011B1000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.4MB

                                                                                                          Download

                                                                                                        • memory/3004-900-0x0000000000E70000-0x00000000011B3000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/3528-109-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/3528-98-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/3568-796-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-20-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-1124-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-21-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-1668-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-151-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-18-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-24-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-27-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-1020-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3568-19-0x0000000000311000-0x000000000033F000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                          Download

                                                                                                        • memory/3764-5529-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/3764-5525-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/3968-5526-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/3968-5530-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/4092-2242-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/4268-1141-0x0000025DE6EE0000-0x0000025DE6FA8000-memory.dmp

                                                                                                          Filesize

                                                                                                          800KB

                                                                                                          Download

                                                                                                        • memory/4320-1048-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-1678-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-57-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-180-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-1534-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-153-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4320-883-0x0000000000130000-0x00000000005F3000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.8MB

                                                                                                          Download

                                                                                                        • memory/4408-835-0x0000000000820000-0x0000000000B63000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          Download

                                                                                                        • memory/4532-818-0x0000000000CE0000-0x0000000000DBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/4532-837-0x0000000000CE0000-0x0000000000DBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/4696-967-0x0000000000380000-0x0000000000C35000-memory.dmp

                                                                                                          Filesize

                                                                                                          8.7MB

                                                                                                          Download

                                                                                                        • memory/4736-885-0x0000000000250000-0x000000000032C000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/4736-905-0x0000000000250000-0x000000000032C000-memory.dmp

                                                                                                          Filesize

                                                                                                          880KB

                                                                                                          Download

                                                                                                        • memory/4780-1063-0x00000000003D0000-0x00000000006D4000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.0MB

                                                                                                          Download

                                                                                                        • memory/4780-1079-0x00000000003D0000-0x00000000006D4000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.0MB

                                                                                                          Download

                                                                                                        • memory/4920-92-0x0000000000930000-0x0000000000BDE000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/4920-93-0x0000000000930000-0x0000000000BDE000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/4920-94-0x0000000000930000-0x0000000000BDE000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/4920-620-0x0000000000930000-0x0000000000BDE000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/4920-181-0x0000000000930000-0x0000000000BDE000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          Download

                                                                                                        • memory/5116-107-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/5116-97-0x0000000000310000-0x00000000007B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                          Download

                                                                                                        • memory/5288-1573-0x0000000000BF0000-0x0000000000EDC000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/5288-1535-0x0000000000BF0000-0x0000000000EDC000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.9MB

                                                                                                          Download

                                                                                                        • memory/5316-1670-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/5316-1671-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/5588-1547-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                          Filesize

                                                                                                          460KB

                                                                                                          Download

                                                                                                        • memory/5588-1551-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                          Filesize

                                                                                                          460KB

                                                                                                          Download

                                                                                                        • memory/5588-1548-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                          Filesize

                                                                                                          460KB

                                                                                                          Download

                                                                                                        • memory/5588-1550-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                          Filesize

                                                                                                          460KB

                                                                                                          Download

                                                                                                        • memory/5696-1542-0x0000000000970000-0x000000000109F000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.2MB

                                                                                                          Download

                                                                                                        • memory/5696-1497-0x0000000000970000-0x000000000109F000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.2MB

                                                                                                          Download

                                                                                                        • memory/5904-1640-0x0000000000E70000-0x0000000001284000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.1MB

                                                                                                          Download

                                                                                                        • memory/5904-1639-0x00000000736A0000-0x00000000736C6000-memory.dmp

                                                                                                          Filesize

                                                                                                          152KB

                                                                                                          Download

                                                                                                        • memory/5904-1638-0x0000000073550000-0x000000007364B000-memory.dmp

                                                                                                          Filesize

                                                                                                          1004KB

                                                                                                          Download