Overview

overview

10

Static

static

1

hel.txt

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    236s
  • max time network
    300s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-uk
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-uklocale:uk-uaos:windows10-ltsc 2021-x64systemwindows
  • submitted
    10-11-2024 14:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hel.txt

  • Size

    890B

  • MD5

    94c2e0523a20c9583fdb3883fe6f494e

  • SHA1

    4aeb3a7075f7ca9b71f34eca1c3ffdbba9b41c40

  • SHA256

    dcd9462812ba185cf250b29936715542111862db0dac6f2b8ac3ab12e0afa9f1

  • SHA512

    159721547483b688c4a19038df0acacfd9e77146b1ab8a1a2d3713c260a6247ff0a11d7f0b66e62692e4a8ccddf4db82b912c8a03526eb6eea6335b87fdab0e0

Score
10/10
modiloaderaspackv2defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Windows directory 21 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\hel.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3604
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
    1⤵
      PID:2728
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Subvert Trust Controls: Mark-of-the-Web Bypass
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1840 -prefsLen 23646 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {476b8cff-cf90-42c5-aa8e-5f755926dc32} 940 "\\.\pipe\gecko-crash-server-pipe.940" gpu
          3⤵
            PID:2512
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 23682 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97cd428d-08d2-4c39-b1f9-264510cf8447} 940 "\\.\pipe\gecko-crash-server-pipe.940" socket
            3⤵
            • Checks processor information in registry
            PID:2864
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2980 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 1548 -prefsLen 23823 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e12ae45-6c04-4cd3-9fcb-ee0452202449} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
            3⤵
              PID:2484
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 1268 -prefsLen 29056 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26023c72-32c2-4212-b22c-7733d6710091} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
              3⤵
                PID:2436
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4772 -prefMapHandle 4728 -prefsLen 29056 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67437fd5-c8c7-49a3-bd14-fd834846c4f1} 940 "\\.\pipe\gecko-crash-server-pipe.940" utility
                3⤵
                • Checks processor information in registry
                PID:6068
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 3 -isForBrowser -prefsHandle 5640 -prefMapHandle 5636 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a688b94-9a72-49cf-a4b7-63e37fc81c36} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                3⤵
                  PID:5716
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {420d1573-2918-4a3e-ac7d-ac8fd570c5a9} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                  3⤵
                    PID:4620
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6072 -childID 5 -isForBrowser -prefsHandle 6080 -prefMapHandle 6088 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9f25058-0974-4c01-b894-214d3b74af2e} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                    3⤵
                      PID:5056
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6048 -childID 6 -isForBrowser -prefsHandle 6136 -prefMapHandle 6140 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc237b90-5080-4e8a-b8af-35a19fee4045} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                      3⤵
                        PID:3912
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6140 -childID 7 -isForBrowser -prefsHandle 6384 -prefMapHandle 5676 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e13631d0-5143-4c04-a76e-7f22635ab08e} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                        3⤵
                          PID:5920
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5152 -childID 8 -isForBrowser -prefsHandle 6140 -prefMapHandle 6580 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31235b12-6eb9-4345-ac77-d8948b68ea4b} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                          3⤵
                            PID:3824
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 9 -isForBrowser -prefsHandle 5864 -prefMapHandle 5780 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d713a2c-bd48-4015-98f3-61986b1e0044} 940 "\\.\pipe\gecko-crash-server-pipe.940" tab
                            3⤵
                              PID:2036
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:4688
                          • C:\Users\Admin\Desktop\VC_redist.x86.exe
                            "C:\Users\Admin\Desktop\VC_redist.x86.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4356
                            • C:\Windows\Temp\{74571FDF-6883-4E24-B3AD-3D24A3D439E5}\.cr\VC_redist.x86.exe
                              "C:\Windows\Temp\{74571FDF-6883-4E24-B3AD-3D24A3D439E5}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Desktop\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=560
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:4672
                          • C:\Windows\System32\notepad.exe
                            "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241110143344.log
                            1⤵
                            • Opens file in notepad (likely ransom note)
                            PID:4824
                          • C:\Users\Admin\Desktop\WinLocker Builder v1.4.exe
                            "C:\Users\Admin\Desktop\WinLocker Builder v1.4.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            PID:3928
                          • C:\Users\Admin\Desktop\обуксі.exe
                            "C:\Users\Admin\Desktop\обуксі.exe"
                            1⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Impair Defenses: Safe Mode Boot
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5648
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe"
                              2⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Drops file in Windows directory
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1988
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1088
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1212
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5676
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2808
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SendNotifyMessage
                            PID:4604
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1960
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4304
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SendNotifyMessage
                            PID:3448
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4532
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2124
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4556
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:904
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3748
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5684
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5264
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:1096
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4300
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3732
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1320
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:1540
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2172
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5252
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5900
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:3480
                            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\StepCompare.xltm"
                              2⤵
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Suspicious behavior: AddClipboardFormatListener
                              • Suspicious use of SetWindowsHookEx
                              PID:3772
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2872
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2756
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:480
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:4784
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5208
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4048
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4720
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:1232
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3824
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4888
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                  1⤵
                                    PID:5740
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4112
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3516
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1188
                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                          1⤵
                                            PID:5476
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:5184
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3916
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:5536
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                  1⤵
                                                    PID:5212
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1156
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3956
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1148
                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                          1⤵
                                                            PID:1952
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:5616
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4232
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2352
                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                  1⤵
                                                                    PID:2536
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1544
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:5156
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4388
                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                          1⤵
                                                                            PID:1472
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:5084
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:720
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:5128
                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                  1⤵
                                                                                    PID:4380
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2192
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:428
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:3824
                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                          1⤵
                                                                                            PID:188
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3356
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4740
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4196
                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                  1⤵
                                                                                                    PID:704
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:5652
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:5420
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:5268
                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                          1⤵
                                                                                                            PID:3312
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:8
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2828
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3976
                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                                  1⤵
                                                                                                                    PID:2164
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:5508
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:6112
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4556
                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                                          1⤵
                                                                                                                            PID:2560

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\1058\StructuredQuerySchema.bin
                                                                                                                            Filesize

                                                                                                                            466KB

                                                                                                                            MD5

                                                                                                                            7ea569828ec16b673e5d40ef9f152d54

                                                                                                                            SHA1

                                                                                                                            987e38fdcdf4ee2a4217d108db16761e0d235714

                                                                                                                            SHA256

                                                                                                                            3d65900347da206664ba42fb4a6f6687595493e8af4e7162f4c41883902cc482

                                                                                                                            SHA512

                                                                                                                            f73f8554a1b9c039790a30062aa1cd229dbc925cfe5f238e10a25305f5ebdcf3ef6fadd1f87f4ada69fb5419276513c4d51dffbeafa4d277f835a44c2262271c

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133757229255417638.txt
                                                                                                                            Filesize

                                                                                                                            82KB

                                                                                                                            MD5

                                                                                                                            ad2d74ef7260f50c6c96cec99384bfa1

                                                                                                                            SHA1

                                                                                                                            32d3c02f89b3c0ffc04a4f0eb13d25046a773a47

                                                                                                                            SHA256

                                                                                                                            a68fa9b75c92481c9941d51d6acafcf2cded761a5a8fcf9e46800dfd863e59c2

                                                                                                                            SHA512

                                                                                                                            cae76dabb16146fb6f70bb5c8107eedb507a31ca18f15f31ee70086f3453076ebd837eb13e296032c2e859469f65706f1ad3ffe88b38277cce0151120eff34c8

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\W3Y3NP6R\microsoft.windows[1].xml
                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            f3f5be4a1e92ee60fb3d59d6351b56bb

                                                                                                                            SHA1

                                                                                                                            9f1722ab79b98d81de843e8161220b30a259091f

                                                                                                                            SHA256

                                                                                                                            416cb1ff3ce28e1242cbd19ae656d754a3377c9824109c407cf03968a1f4a9ac

                                                                                                                            SHA512

                                                                                                                            ea91d2c7d8c617bfbc1f4d6a5fd260baca86504a477fa7717c9d763889c9bae937a1688097e1368096fc32859dbd66a4707497b2d18b0b5caa9384ee4618c723

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241110143344.log
                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            MD5

                                                                                                                            acab76eaa7db6dcfc8072b9b13cf5809

                                                                                                                            SHA1

                                                                                                                            31da15e87b81be179dfb925aee9e4ad9c71c6fa6

                                                                                                                            SHA256

                                                                                                                            ac419adce1e0265d51ea0a19236275bfcc47bac5b56902653354fa915c329efa

                                                                                                                            SHA512

                                                                                                                            ddb0cb8ecd302f6fe6ed78300be5e73d2ce48764e59a50e6b028a3723c06ce5fbc67e41e599cc8fdd9d7394e1568c124c29f93da99576ad85f951c2441786180

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                            Filesize

                                                                                                                            479KB

                                                                                                                            MD5

                                                                                                                            09372174e83dbbf696ee732fd2e875bb

                                                                                                                            SHA1

                                                                                                                            ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                                            SHA256

                                                                                                                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                                            SHA512

                                                                                                                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                                                            Filesize

                                                                                                                            13.8MB

                                                                                                                            MD5

                                                                                                                            0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                                            SHA1

                                                                                                                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                                            SHA256

                                                                                                                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                                            SHA512

                                                                                                                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\AlternateServices.bin
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            dc3c5f50ef24e155dd4d2abfe2fa0208

                                                                                                                            SHA1

                                                                                                                            17c82ce50cfb86797d34d6bc8183a0dec0671824

                                                                                                                            SHA256

                                                                                                                            25b996890aeaa360ec7bc72b1eb6afa90538eba14afe8cf9830693e007880757

                                                                                                                            SHA512

                                                                                                                            04dfd4d043f7bc1728f870fa7ab07f427cb020dd04b12b48173a1feed62b0986226e8b5120b726f4b827a6a1c2f37b1339d19d49faed67568f2ea79f3c4cb92c

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\AlternateServices.bin
                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            176acdedf817f577d841195f81fa234d

                                                                                                                            SHA1

                                                                                                                            5aa388c221cd617eb564049d3ea5674cf0c241a4

                                                                                                                            SHA256

                                                                                                                            8de441e653dc5557e98c7a25bf4d884c9bc6652c35fadf8bb7e334c379ce1f94

                                                                                                                            SHA512

                                                                                                                            3202fe6dd8f5e9975f29977b4d6101c2025daceb86f748f3d0ad55683dde8b2e15faea991b1e9bab11456371bc232ab37849270be09ef1eb4c04704b7bb4fc42

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                            Filesize

                                                                                                                            21KB

                                                                                                                            MD5

                                                                                                                            ab643ea437f94d78d924fccc8f594825

                                                                                                                            SHA1

                                                                                                                            f6ce19e7838bb2607e10d058b68cdc257e4f1cb9

                                                                                                                            SHA256

                                                                                                                            4e09b18e6be934fb19a3a78de2c69f9abf39eee17ce735621efb8adce585bab7

                                                                                                                            SHA512

                                                                                                                            6181cb9ec0f253fe53169af143d75f9c90e83e85905c7a61883a58d271a7720ba2ab5e75ad7e574546569db3a61c579d5969ef4d87c736221099e7c03030fa4e

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                            Filesize

                                                                                                                            5KB

                                                                                                                            MD5

                                                                                                                            a076681248f8e2faba393d039676a427

                                                                                                                            SHA1

                                                                                                                            cc3b118904e474b1a7d080df86c6ebf5b0ba7f18

                                                                                                                            SHA256

                                                                                                                            67c72e811b40a71dfc38ce42f2dc6b36ff635b41443a9f842276498d3232e5e5

                                                                                                                            SHA512

                                                                                                                            4e0217e4703bdf758fbe281b5b82f7a4d2958a08255a8720c6e7c781611c73264fbcc12a2fd291b73e0cab6a8b280b0ad23ec16ba752fa1365a2c09a781740e0

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\37086809-ffc6-4819-b885-b22b63ca3e16
                                                                                                                            Filesize

                                                                                                                            982B

                                                                                                                            MD5

                                                                                                                            87dd462f1bafb08f2f79501650da18e0

                                                                                                                            SHA1

                                                                                                                            c23fd71ec441b416bc40c0667483befd24c8d6a4

                                                                                                                            SHA256

                                                                                                                            ffa6e768682580b693da6a9445b74f57995d6b58a43c3aac053ac028509d2e84

                                                                                                                            SHA512

                                                                                                                            01922b73e553640d34cefb48e3f3e1f6830aaad9a129a85ba8d26874b63e4a75ce957da04ec5d3e5a98d01de4eefa708f5b445309104e635012716f0b159cd73

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\531ea063-26f4-4885-8c1a-001c05375323
                                                                                                                            Filesize

                                                                                                                            26KB

                                                                                                                            MD5

                                                                                                                            b7efbe88bd1586f67a6581d68a87cf1d

                                                                                                                            SHA1

                                                                                                                            ae769e0bf8714cd980bacb1981f8c6de57c95dc1

                                                                                                                            SHA256

                                                                                                                            710929121f89592f209e29b1291bf69a67b0a464c99fe14eb28df94a852c648f

                                                                                                                            SHA512

                                                                                                                            5a66cedc16bdda65025d2a767ef212cbac2a91f7cb1325f03935126d1ef0b8376b0f6651634780892f2cbff3947c3bb190495fe2d4ac1d61afa0820f54966ff4

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\adc8e5b1-fa36-4f28-bc87-729e0f9bce4b
                                                                                                                            Filesize

                                                                                                                            671B

                                                                                                                            MD5

                                                                                                                            eeb1560adb334498e3f2d296dae40dbb

                                                                                                                            SHA1

                                                                                                                            47250cc6933de8f3cb135337e5c3e4d7e781e06d

                                                                                                                            SHA256

                                                                                                                            996eb5b9fcb06b734b6b7f508267ce1ffb891c845a1a0720458d002769650e17

                                                                                                                            SHA512

                                                                                                                            f875749dd7acbfada70acd4551b071734f1d450973c9f1c958a1cfb2081fbca50502f0c10206b537c73f5b6ff32ef7333fe25d416a04c53096bf529c3935a6ae

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\f48f93e5-6303-4090-a998-abc5da4d01ff
                                                                                                                            Filesize

                                                                                                                            20KB

                                                                                                                            MD5

                                                                                                                            c102bc43119e86f2d34a06aa084463a8

                                                                                                                            SHA1

                                                                                                                            c404415d722469f0cbfa83682e9a331655725076

                                                                                                                            SHA256

                                                                                                                            095f49a3dc3e58e892d5c32f6e82f0c3f9421e857de8747237a198515712f0e0

                                                                                                                            SHA512

                                                                                                                            52fe03e9fb73f0f8e5eacda9f43aa7d5a6c7ad682cb23a7336cc0fd2fc3be1ae6fcd491a99f39ae9f9ab19cb8ebbd657416b15112f665cd444587aeff11d0cf6

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                            MD5

                                                                                                                            842039753bf41fa5e11b3a1383061a87

                                                                                                                            SHA1

                                                                                                                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                                            SHA256

                                                                                                                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                                            SHA512

                                                                                                                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                                                                            Filesize

                                                                                                                            116B

                                                                                                                            MD5

                                                                                                                            2a461e9eb87fd1955cea740a3444ee7a

                                                                                                                            SHA1

                                                                                                                            b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                                            SHA256

                                                                                                                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                                            SHA512

                                                                                                                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                                                                                            Filesize

                                                                                                                            372B

                                                                                                                            MD5

                                                                                                                            bf957ad58b55f64219ab3f793e374316

                                                                                                                            SHA1

                                                                                                                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                                            SHA256

                                                                                                                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                                            SHA512

                                                                                                                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                                                                                            Filesize

                                                                                                                            17.8MB

                                                                                                                            MD5

                                                                                                                            daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                                            SHA1

                                                                                                                            f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                                            SHA256

                                                                                                                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                                            SHA512

                                                                                                                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs-1.js
                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            e9d98d2a00ff0a869311057671c35a49

                                                                                                                            SHA1

                                                                                                                            979d81f25c5a75ddf402acb40570e796c7535579

                                                                                                                            SHA256

                                                                                                                            d1d412a65e069ce970b857515d90597852823e2dc71566be36be8e376338fa81

                                                                                                                            SHA512

                                                                                                                            e87bca2ccc52031990eb42e45568a762e5438cbaa0054568f55b6189b3362f18cbc12cf0767766c13576d13cb538d35c4bf7ddfbf70c5445a040f9d60e59bfa7

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs.js
                                                                                                                            Filesize

                                                                                                                            10KB

                                                                                                                            MD5

                                                                                                                            906a2734ca03232fff5f12dbdbe77a6c

                                                                                                                            SHA1

                                                                                                                            39cd27a3bb3b9225b09a8f46362943ae385910a4

                                                                                                                            SHA256

                                                                                                                            7b87c05ecaddb42a8f664e624fc0e2ac1dd62e31baec6e5ef3811155605f6960

                                                                                                                            SHA512

                                                                                                                            b99a393c42a8aed24ccc9898a24943b4653a77b06c4863772613a123dbe725edd3230ec51bd23c36c1cd5d98b8d8cc45763bc82deeb78f4e6be9eafbf33f92d3

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            2c778a55ff313d0fe870960ca9a03a4b

                                                                                                                            SHA1

                                                                                                                            f1c6970c46ce0d79c8662b7857677794dc6f38a2

                                                                                                                            SHA256

                                                                                                                            ff798ee147505379aa807c03dede059fc34c71acf4a90aa5d1c71f67bd0e9696

                                                                                                                            SHA512

                                                                                                                            c8b561a0a5f4fa13633ce4e6126fac2addcef5c7fb0ed3a4e4c8b46921f9423242fa78b80eadeb7543693fb8db03fe08e8b7c5486c092fd826eb31f6e74dc0e6

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            MD5

                                                                                                                            7528709f9eb70eb6a98c70320171706a

                                                                                                                            SHA1

                                                                                                                            749b7ddd2f0678493ff4f9bd52055a3eaea9de30

                                                                                                                            SHA256

                                                                                                                            035ce5e95e246ba9bcfa0c405aed4c62465db2351bfddec6923d6b5d16b722de

                                                                                                                            SHA512

                                                                                                                            8194296a53c3e41cfff3c32d3cb69101f5fcafc61388bd421e1b79fff33f04276a2a8cf16efbc24621ab2a5120780571253449d333b2e2d2d90bcec11055c744

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\RCXE24A.tmp
                                                                                                                            Filesize

                                                                                                                            387KB

                                                                                                                            MD5

                                                                                                                            2f8efa8cc280c5569555be4a988453ec

                                                                                                                            SHA1

                                                                                                                            1416cec10d88ad16b00a478edbe2af2290c0965c

                                                                                                                            SHA256

                                                                                                                            fc22b82bfd03e2750c0a057f496e43367fb487c9369c2b3646cab21e7fd4d9c1

                                                                                                                            SHA512

                                                                                                                            910c33ccd5510e22600f6b091304da459a2e62c993bbcdd1512771e8cec5a4a7fffc859ea8524def5e78a466968409481064ffbdbe584f52bf752c1b7e968743

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\обуксі.exe
                                                                                                                            Filesize

                                                                                                                            382KB

                                                                                                                            MD5

                                                                                                                            97eb6f7ec0586fe37b82dbe2f522da35

                                                                                                                            SHA1

                                                                                                                            7b9995845a89aec0a6eabe7e9eeb446abe8e5d58

                                                                                                                            SHA256

                                                                                                                            f738afbd4c316267d35e2f4d7b818139a55d8ef6b636c3bf736f1672cb4c8ea1

                                                                                                                            SHA512

                                                                                                                            888850fe4ea693a5168d6c0f2ab638862dc1a09a1e25f1de8cbfb373753cad982f2461826f5fa54144ba04ff6ed2c19c5850d70a3a2edc3bbb2024cf42710c49

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Downloads\VC_redist.4-PFZQAq.x86.exe.part
                                                                                                                            Filesize

                                                                                                                            13.1MB

                                                                                                                            MD5

                                                                                                                            ca778a97f31d6ab131f1e0bb58a466fb

                                                                                                                            SHA1

                                                                                                                            5b8637acc24f11e9bf83c77aacc8d529ea62d173

                                                                                                                            SHA256

                                                                                                                            91c21c93a88dd82e8ae429534dacbc7a4885198361eae18d82920c714e328cf9

                                                                                                                            SHA512

                                                                                                                            e2de89cb69803339f765bc1b29a7d6b24effd079f8296463ae6be0a0fdc99d2df2bc742c77b1e22ec320366ada672c022605c26ce21f7a59ba9246df8be9e27d

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Downloads\WinLocker Builder v1.4.exe
                                                                                                                            Filesize

                                                                                                                            699KB

                                                                                                                            MD5

                                                                                                                            81dd862410af80c9d2717af912778332

                                                                                                                            SHA1

                                                                                                                            8f1df476f58441db5973ccfdc211c8680808ffe1

                                                                                                                            SHA256

                                                                                                                            60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

                                                                                                                            SHA512

                                                                                                                            8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\acpi.PNF
                                                                                                                            Filesize

                                                                                                                            10KB

                                                                                                                            MD5

                                                                                                                            2d04403bc87009b42ec82cbf9b764216

                                                                                                                            SHA1

                                                                                                                            6078dbc688ed69d448d7febe77fc54f514e9c63f

                                                                                                                            SHA256

                                                                                                                            031c7ca62e295685b7ceb88805efa30fded36b53113e1d87e748d5acc169de6d

                                                                                                                            SHA512

                                                                                                                            d8a89ecb405637a71435caadcb000ced3822398a219c370f2ea61eb83c320ba80c3b62930454e61b68f9ec49c44137c6acfad7be26caf4306da6b6997cef608e

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\cdrom.PNF
                                                                                                                            Filesize

                                                                                                                            11KB

                                                                                                                            MD5

                                                                                                                            e60ca9a0edad310f3dc46f5ea2b2e417

                                                                                                                            SHA1

                                                                                                                            ad280c61e239d89a5969beb9daa2d33bf82ef719

                                                                                                                            SHA256

                                                                                                                            b651c04de0085dd8e597d36b0e3fdb172dbd387fc2fdb119d18e80982afbbec9

                                                                                                                            SHA512

                                                                                                                            97fc0b8f35457c6df0f257c0722a3e05d312b7bc3ef730d512e7862f6a62f15f929f4fc8cd26bc52701facffa5d46517db90802cf28ee3d6c5ce1d1b4bc5d6a7

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\compositebus.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            7057a340d445065a2fb7fae0b7a4e163

                                                                                                                            SHA1

                                                                                                                            728c23443b7a04ee08fde5f2795f9896559d0628

                                                                                                                            SHA256

                                                                                                                            fe80150a9e4a4f50d7b0c90b553d81b9ebf87b09ce53dc74469168bc5503c317

                                                                                                                            SHA512

                                                                                                                            52118eed0628c7a46056bc8a198654cc8034c17b904a85683b9e4a0f0506fdb45791650ad0652028adefb0a239a9d87e93c53e2f7df4d821736a3df6db92991a

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\hdaudbus.PNF
                                                                                                                            Filesize

                                                                                                                            9KB

                                                                                                                            MD5

                                                                                                                            5cd415a4bb5137163894297ead7c64bc

                                                                                                                            SHA1

                                                                                                                            5190643f33786be8c007da49c5fe1de075cdd6fc

                                                                                                                            SHA256

                                                                                                                            9225595d073c891326f58aba1daad5b9b09074e0e92d933d95292b9aa1a11e29

                                                                                                                            SHA512

                                                                                                                            086286e5d88cc35a7457993a2ef46f0ec0eb6f0b629da3d6649cbd65180e6dc26854d67ad94423147d7a93665e4b19ede26712282287fab37ed628bf1c1249c0

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\hdaudio.PNF
                                                                                                                            Filesize

                                                                                                                            94KB

                                                                                                                            MD5

                                                                                                                            46c17469571dc1da8da57e615708ced5

                                                                                                                            SHA1

                                                                                                                            76d4409b4b66087236a872c49cab44048218d62e

                                                                                                                            SHA256

                                                                                                                            55d895a43bd6a74f82824e0a13b88852b4fe5eca9d10d469f822fbcb72b191e4

                                                                                                                            SHA512

                                                                                                                            96a956b14d2d38c434ecc9a3d37c456a53599f0dfc9bcdfbfbee4da8212f54ea558477407d7e69d1611c9511aea533298aae08069d7dbdc57e6c546e347e7f9b

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\input.PNF
                                                                                                                            Filesize

                                                                                                                            138KB

                                                                                                                            MD5

                                                                                                                            ba7ac81634403405b646cf5dfb0b34d3

                                                                                                                            SHA1

                                                                                                                            80ac01cc0a5b1e9ebde130bcfd28e30e698d58d6

                                                                                                                            SHA256

                                                                                                                            c4ab9b59c1a0208cf8b099f2c1a73b00d5d098e071c21bb7d522141ed09768c3

                                                                                                                            SHA512

                                                                                                                            660d89542e38466003cbe4ef9857750540793f7b5f71976bbeb7dde433fc1c2e3bda4415f4fc7212d46cce56397e92fc6f5f259ed159de62bd941a9d599f7de4

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\keyboard.PNF
                                                                                                                            Filesize

                                                                                                                            109KB

                                                                                                                            MD5

                                                                                                                            55d5c9cf77e9438e7bd323cbc69d142e

                                                                                                                            SHA1

                                                                                                                            0ead49160d1bf1ae606be2a5b6e9afab6e731f07

                                                                                                                            SHA256

                                                                                                                            5c2391425bb9b39f857f2c6a6fb302145154fe100dd15338e4f75c8a0b7d678e

                                                                                                                            SHA512

                                                                                                                            bf88836c4ccc591063f771fb0ddc9f1a12d752796e5f2a4e3261e95db4fe7b759b0cd73e9562be9f9544cf5697603deaed39111d1160afc5ed75941784cdaba2

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\monitor.PNF
                                                                                                                            Filesize

                                                                                                                            1.1MB

                                                                                                                            MD5

                                                                                                                            de860c4a9e912b368db1e558a56980f1

                                                                                                                            SHA1

                                                                                                                            e223faa66ac34865b9c8ff7eeecbf1be31d140bf

                                                                                                                            SHA256

                                                                                                                            a27ff8042758592d995456d6244a2d3f6b7637d65a4067eb3acf3a4a44169868

                                                                                                                            SHA512

                                                                                                                            5374895a50ed07d820a5b4fe8d4c038e1dfa25453893c0c23b53c6bbf621dc1936093e32e3240ec72eb82bc008771100cc38c29790c4c8f97fe117cd4be62d27

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\mshdc.PNF
                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            MD5

                                                                                                                            337f102bd16c3293604c04026cc0cdfa

                                                                                                                            SHA1

                                                                                                                            3b445dca6ff1e975863e40e984aff95c9f7ca0f7

                                                                                                                            SHA256

                                                                                                                            a08b808870b39af0979ff175c3556d3946f35ce43aaa74ff450704ac87cd1ad9

                                                                                                                            SHA512

                                                                                                                            b84316b0881b2217282dd7f3bc521656577654e6e1d6e728b802efb2bf07a7e0940a42d72e16d8edde860c6c774e8753a6cb7e7995d034b395e8ccb7573f27de

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\msmouse.PNF
                                                                                                                            Filesize

                                                                                                                            89KB

                                                                                                                            MD5

                                                                                                                            743d75f69b2edc19d66fda82330149af

                                                                                                                            SHA1

                                                                                                                            0c233c03b531ad66ab6fe7f6429f7a3d86e677a1

                                                                                                                            SHA256

                                                                                                                            9b4b778b445fe86cc7ecd65b6f7b9eb0a1a7eedac3431b67138452e261f1c420

                                                                                                                            SHA512

                                                                                                                            8d9c78f3b6938b976a98ef39436648c845beabc808c11dc382c9d3d15781120cd2c080c8a19066dd903c7214bbd7c8ad8757b7491851a8d21c80e0610ea5454d

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\mssmbios.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            cd60b136070427e5dc8c960b9b9fb5ad

                                                                                                                            SHA1

                                                                                                                            2a6f4c3d9a2bf9b9d15b16adef58085a33ce62d3

                                                                                                                            SHA256

                                                                                                                            8409e0e712a0a829246258523989181ca1a03e98523c5fce1354d0f74521d081

                                                                                                                            SHA512

                                                                                                                            db7c7236823b8681630a3e1b165a73f4d5721f1946368f3af9e2b261c23d9ec626b5b96d8dfe7a4577e06dc84cf3f608387ebb50732bdfb7b48c7ff7528034f6

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\pci.PNF
                                                                                                                            Filesize

                                                                                                                            20KB

                                                                                                                            MD5

                                                                                                                            c6d642863e41aa053e6dbe5d31313b85

                                                                                                                            SHA1

                                                                                                                            4692d060a47df889984bb0431c204b5c4f425ee2

                                                                                                                            SHA256

                                                                                                                            5122d6f269d3a8fa7cec7eb9e54164ac6c492a5ef2bd4cf0a1f18b4e52d6e1c4

                                                                                                                            SHA512

                                                                                                                            6cc1a0602519670646a1c0fe16471ed28ca0f4211f500ec14d42bbb670f016be8d5482c8691c0cb5ca5787e16990230415266885a0e43c5507a3db396f6b29d9

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\rdpbus.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            14e249a5f591032e3bebdd961a371453

                                                                                                                            SHA1

                                                                                                                            43068e537b0d567ad4a07e610973a7faa2f90454

                                                                                                                            SHA256

                                                                                                                            285cc4c43bcddebf9bb3841e1c929d15f1b743643385075292969b6c14539016

                                                                                                                            SHA512

                                                                                                                            7754bc9db23b22775c026e33100d3051926911bd3b206d703307a81d8e75a2010d61cf118512f0a2c7c9a73fdf8ebed1af4e9dcdd2df6a0368dc61746d23b4de

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\spaceport.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            432a1813f8badb57081754089e1e01bc

                                                                                                                            SHA1

                                                                                                                            e905c7d141aa47ff495d3b22e5d6dda169b454ad

                                                                                                                            SHA256

                                                                                                                            f9a95771bb9cf9ba2ad119a6180d4e2c7ff5bec4d237e357695bb79b6ef12842

                                                                                                                            SHA512

                                                                                                                            97ec6edfd36b749fb8c9d0b6135f2e8f6e18f89139270ab3ea0a8ed5589f84511c20d40400c8bff488ae9685d346e442c199af12e706385a29553f137a201bd0

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\swenum.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            c55b2979b85d9ede475c51a1ede7196b

                                                                                                                            SHA1

                                                                                                                            78356e90eca15d4453195b2b6a26bc4732ca4d54

                                                                                                                            SHA256

                                                                                                                            7a16daddbd9f77fe318e9195980e8f1fc4e892f8759471fe23492a02f0855b72

                                                                                                                            SHA512

                                                                                                                            1043a13f9b46e7e54e42307dae6531834d70b0d8ff3aba3bc79dbe9d4ee3b1f044ae5f157fead04e4a14ae3c4e888f860cf1e1fbcf3fe04f930a766d810b0fc9

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\umbus.PNF
                                                                                                                            Filesize

                                                                                                                            9KB

                                                                                                                            MD5

                                                                                                                            6d4a966a4ccc67b85f32e54ab8c0e060

                                                                                                                            SHA1

                                                                                                                            933d707cff28ab76e8d61b272dbd662e6afe0fd0

                                                                                                                            SHA256

                                                                                                                            e2f941995556c9a1a98c5d778f143a312a8424af87e4df7a1388f6aafd29a69c

                                                                                                                            SHA512

                                                                                                                            cf1e74b27a887c78a6ec3dd0ce7ee531c9817039bcceabe2ab7cd4d713d91ddc8d8ce42f6b592f1647e3db05cd2bacce9b69f6a93be86c3e3733404e284c5352

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\usbport.PNF
                                                                                                                            Filesize

                                                                                                                            131KB

                                                                                                                            MD5

                                                                                                                            a5572b2bc333df2b3ff29caa72e2366a

                                                                                                                            SHA1

                                                                                                                            be20bab2ff6a4c2d4a0f6a332346ff834bfecdc2

                                                                                                                            SHA256

                                                                                                                            44bfd878bcfbddac9bbf797eef14f3732a15055e933eec149b1ef1e48d910f80

                                                                                                                            SHA512

                                                                                                                            c014e6bba02b93c1979b348717a1e1b2867a8a42d9aebe807d6a20fbb29b47c512bf10d991af0e8e172bd0b42e286d48d616bc8b8d42937b46be038d2bdd647b

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\vdrvroot.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            a37b9cf8161c4875267b44492045b54a

                                                                                                                            SHA1

                                                                                                                            069e6d89ae2000ec0c0ea966c190df549a04d4d4

                                                                                                                            SHA256

                                                                                                                            b4c25197abd25a7c7ed3fda9b7ed5ffd1e7af284ef1bf546fad032810271791a

                                                                                                                            SHA512

                                                                                                                            8829662bdf3b865b89498039d1d6a3453a59b125f99e7350c05c933054d41563c3c6595164657394b341a7957b40bd0dceac42f23003946670c7628cfe07aa9a

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\vhdmp.PNF
                                                                                                                            Filesize

                                                                                                                            7KB

                                                                                                                            MD5

                                                                                                                            230b8b5d6034fb1d21129c652aeb2a15

                                                                                                                            SHA1

                                                                                                                            8068e11a9e83957d0a5b234d9921ffc15a13b25b

                                                                                                                            SHA256

                                                                                                                            5c561783ccb8f72c1f5e41030cecea4bda50c9c8ffaf972cd5af9ac07ac0df45

                                                                                                                            SHA512

                                                                                                                            85ee22c9c135ab089709a00053caa4fe2a54258a1ba4cf8c03c204e0bedc888000261557c2443bd9e310d3e6fd85d2d8a78150d2ec81cdf8a4d49361a32b1625

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\volmgr.PNF
                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                            MD5

                                                                                                                            e9077d8f1502269fbbc59a3b8fcd6e57

                                                                                                                            SHA1

                                                                                                                            c9ccb492244cb69ff639ddf4c02754d8adfdbd4a

                                                                                                                            SHA256

                                                                                                                            3d2f8b23353746437b98747c9fe06b45b1e4ccf56a75c58bb623db665b669b10

                                                                                                                            SHA512

                                                                                                                            78a8486be98ee62deca3d9e6bed6a0410eef086a05d0a2035e1af4c55cc136e154ec6d87ca6b8a693c429f750fe0e15222262433b468d93982d6276ae69a5c5f

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\INF\volume.PNF
                                                                                                                            Filesize

                                                                                                                            5KB

                                                                                                                            MD5

                                                                                                                            87b9c07261498a2b5e5c92f09bbef45f

                                                                                                                            SHA1

                                                                                                                            4e56f9b7ab27873b762c1fe79a8daee9af8b1c93

                                                                                                                            SHA256

                                                                                                                            2105de6a9f1f5341e339a09841686e8f3eb949a6205ed8b3cc9e7b5292bc156e

                                                                                                                            SHA512

                                                                                                                            4a07dd892dedd04d91582cfcca0f5d77ebe69ebf18f2eef5cc38075f14d826cd698aaca7255d07aab0022200ff165ddf8d06e9a18654d332adbd1f8039748a19

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\Temp\{74571FDF-6883-4E24-B3AD-3D24A3D439E5}\.cr\VC_redist.x86.exe
                                                                                                                            Filesize

                                                                                                                            632KB

                                                                                                                            MD5

                                                                                                                            d34111f1c804b76b2545bbe88cda9d85

                                                                                                                            SHA1

                                                                                                                            1b6d4b7beb22c27a809194d6029cefec3aa605a2

                                                                                                                            SHA256

                                                                                                                            6d357caa2726d154394b4fcd3cebf36e60f3058e23b9938de602ee537bcc4905

                                                                                                                            SHA512

                                                                                                                            2ca8fcab1c6bddef6db00c8e15bf4a1531288ae5c9f822e5856417c87fc4e8211296f47bb48318798367cb9144f519ebdb1e9b48aea9f44cac8ee47b12b9d8e7

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\Temp\{D23766A1-730C-455A-AF83-1653246222C2}\.ba\logo.png
                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            d6bd210f227442b3362493d046cea233

                                                                                                                            SHA1

                                                                                                                            ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                                                                                                                            SHA256

                                                                                                                            335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                                                                                                                            SHA512

                                                                                                                            464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                                                                                                                            Download Submit

                                                                                                                          • C:\Windows\Temp\{D23766A1-730C-455A-AF83-1653246222C2}\.ba\wixstdba.dll
                                                                                                                            Filesize

                                                                                                                            191KB

                                                                                                                            MD5

                                                                                                                            eab9caf4277829abdf6223ec1efa0edd

                                                                                                                            SHA1

                                                                                                                            74862ecf349a9bedd32699f2a7a4e00b4727543d

                                                                                                                            SHA256

                                                                                                                            a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                                                                                                                            SHA512

                                                                                                                            45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                                                                                                                            Download Submit

                                                                                                                          • memory/904-1214-0x0000000003420000-0x0000000003421000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/1096-1314-0x00000000028A0000-0x00000000028A1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/1540-1418-0x00000000030C0000-0x00000000030C1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/1988-980-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/2124-1126-0x0000027EDC5E0000-0x0000027EDC600000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2124-1112-0x0000027EDC000000-0x0000027EDC100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/2124-1146-0x0000027EDD100000-0x0000027EDD120000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2124-1141-0x0000027EDD120000-0x0000027EDD140000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2124-1160-0x0000027EF04F0000-0x0000027EF05F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/2756-1558-0x0000021B205A0000-0x0000021B205C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2756-1572-0x0000021B346B0000-0x0000021B347B0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/2756-1557-0x0000021B205C0000-0x0000021B205E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2756-1543-0x0000021B20580000-0x0000021B205A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/3448-1110-0x0000000003630000-0x0000000003631000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/3480-1522-0x0000000002E90000-0x0000000002E91000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1317-0x000002C7A8600000-0x000002C7A8700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1318-0x000002C7A8600000-0x000002C7A8700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1364-0x000002C7BBAD0000-0x000002C7BBBD0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1349-0x000002C7A8FE0000-0x000002C7A9000000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1350-0x000002C7BA260000-0x000002C7BA280000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/3732-1331-0x000002C7A9700000-0x000002C7A9720000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1630-0x00007FFE454B0000-0x00007FFE454C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1636-0x00007FFE42DE0000-0x00007FFE42DF0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1635-0x00007FFE42DE0000-0x00007FFE42DF0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1631-0x00007FFE454B0000-0x00007FFE454C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1632-0x00007FFE454B0000-0x00007FFE454C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1629-0x00007FFE454B0000-0x00007FFE454C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3772-1628-0x00007FFE454B0000-0x00007FFE454C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            64KB

                                                                                                                            Download

                                                                                                                          • memory/3928-946-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/3928-922-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/3928-923-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/3928-920-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/3928-919-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/3928-918-0x0000000000400000-0x0000000000545000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            Download

                                                                                                                          • memory/4048-1650-0x0000022726740000-0x0000022726840000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4048-1681-0x0000022F28E70000-0x0000022F28E90000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4048-1682-0x0000022F28E50000-0x0000022F28E70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4048-1667-0x0000022F28E30000-0x0000022F28E50000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4048-1648-0x0000022726740000-0x0000022726840000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4048-1649-0x0000022726740000-0x0000022726840000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4784-1646-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/5252-1454-0x00000246C1720000-0x00000246C1740000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5252-1453-0x00000246C1740000-0x00000246C1760000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5252-1436-0x00000246C1700000-0x00000246C1720000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5252-1468-0x00000246D3B00000-0x00000246D3C00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5648-949-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            408KB

                                                                                                                            Download

                                                                                                                          • memory/5648-950-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            408KB

                                                                                                                            Download

                                                                                                                          • memory/5676-981-0x000001EB76240000-0x000001EB76340000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5676-1028-0x000001EB7A410000-0x000001EB7A510000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5676-1011-0x000001EB77240000-0x000001EB77260000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5676-1014-0x000001EB77220000-0x000001EB77240000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5676-994-0x000001EB77200000-0x000001EB77220000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5676-982-0x000001EB76240000-0x000001EB76340000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1250-0x000001E5FB060000-0x000001E5FB080000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1216-0x000001E5F9F00000-0x000001E5FA000000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1217-0x000001E5F9F00000-0x000001E5FA000000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1227-0x000001E5FB040000-0x000001E5FB060000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1222-0x000001E5FAD00000-0x000001E5FAE00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1249-0x000001E5FB300000-0x000001E5FB320000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/5684-1264-0x000001E5FE320000-0x000001E5FE420000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download