Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 16:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    17773f6ab422d27012d0f813eec77035

  • SHA1

    e148f243044c22dd5374d41d4d9c5ae066c454cf

  • SHA256

    34b764f92f6aa319f62bf730e82f02a914cda5c7d7fa665c20a8f2c5430acc4a

  • SHA512

    6e0f75cea50dd43eb019fa5eb66d7e92262b2a7fdc12ab872afbd6339c069856427ce0e7cfd86fcbf17943d7c180a15ce12a9799561330173f485cafaa4ace88

  • SSDEEP

    49152:j5i0B6cfbpQIZyuOO26+iiaSwVgQJwXBUdlOauf7w:jb6cflfSiXNOtRUxuT

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokcredential_accessdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 19 IoCs
    evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 38 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 51 IoCs
  • Identifies Wine through registry keys 2 TTPs 19 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 56 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2860
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3232
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2824
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
          "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            PID:2232
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            PID:3584
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3772
        • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
          "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3928
            • C:\Users\Admin\AppData\Local\Temp\is-BGUTO.tmp\NordVPNSetup.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-BGUTO.tmp\NordVPNSetup.tmp" /SL5="$A0058,15409387,73728,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:452
              • C:\Windows\system32\rundll32.exe
                "rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                6⤵
                • Drops file in Drivers directory
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:3376
                • C:\Windows\system32\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  7⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2868
                  • C:\Windows\System32\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    8⤵
                      PID:4992
                • C:\Windows\system32\regsvr32.exe
                  "regsvr32" "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll" /s
                  6⤵
                  • Loads dropped DLL
                  • Modifies system executable filetype association
                  • Modifies registry class
                  PID:4980
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1452
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1204
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4532
          • C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe
            "C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4136
            • C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe
              "C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe"
              4⤵
              • Executes dropped EXE
              PID:2656
            • C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe
              "C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2968
          • C:\Users\Admin\AppData\Local\Temp\1016971001\6b6179fa92.exe
            "C:\Users\Admin\AppData\Local\Temp\1016971001\6b6179fa92.exe"
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2244
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 544
              4⤵
              • Program crash
              PID:1720
          • C:\Users\Admin\AppData\Local\Temp\1016972001\1aec830598.exe
            "C:\Users\Admin\AppData\Local\Temp\1016972001\1aec830598.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3052
            • C:\Users\Admin\AppData\Local\Temp\1016972001\1aec830598.exe
              "C:\Users\Admin\AppData\Local\Temp\1016972001\1aec830598.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2684
          • C:\Users\Admin\AppData\Local\Temp\1016973001\5bc9625dd1.exe
            "C:\Users\Admin\AppData\Local\Temp\1016973001\5bc9625dd1.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4196
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              4⤵
                PID:1408
                • C:\Windows\system32\mode.com
                  mode 65,10
                  5⤵
                    PID:1808
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3800
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_7.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3044
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_6.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2916
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_5.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:984
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_4.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2648
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_3.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4536
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_2.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4184
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_1.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:720
                  • C:\Windows\system32\attrib.exe
                    attrib +H "in.exe"
                    5⤵
                    • Views/modifies file attributes
                    PID:2336
                  • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                    "in.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2040
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:3052
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:3144
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5020
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.0.0.1; del in.exe
                      6⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3756
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.0.0.1
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:3552
              • C:\Users\Admin\AppData\Local\Temp\1016974001\b283605cfc.exe
                "C:\Users\Admin\AppData\Local\Temp\1016974001\b283605cfc.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4864
                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2712
                  • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2704
                    • C:\Users\Admin\AppData\Local\Temp\onefile_2704_133790121850021883\trunk.exe
                      C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1580
                  • C:\Users\Admin\AppData\Local\Temp\1007235001\4478ed0a43.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007235001\4478ed0a43.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4752
                  • C:\Users\Admin\AppData\Local\Temp\1007236001\0007d13b65.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007236001\0007d13b65.exe"
                    5⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:4932
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 568
                      6⤵
                      • Program crash
                      PID:3668
                  • C:\Users\Admin\AppData\Local\Temp\1007237001\7e60de1197.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007237001\7e60de1197.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:2268
                  • C:\Users\Admin\AppData\Local\Temp\1007238001\7366ab8476.exe
                    "C:\Users\Admin\AppData\Local\Temp\1007238001\7366ab8476.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    PID:1736
              • C:\Users\Admin\AppData\Local\Temp\1016975001\f05b4c5daa.exe
                "C:\Users\Admin\AppData\Local\Temp\1016975001\f05b4c5daa.exe"
                3⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3208
              • C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe
                "C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:896
                • C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe
                  "C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:5332
                • C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe
                  "C:\Users\Admin\AppData\Local\Temp\1016976001\4478ed0a43.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5340
              • C:\Users\Admin\AppData\Local\Temp\1016977001\6cc50f9433.exe
                "C:\Users\Admin\AppData\Local\Temp\1016977001\6cc50f9433.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:588
                • C:\Users\Admin\AppData\Local\Temp\YX3BKWRYX9UH4TCB1U2YWA0LGU9.exe
                  "C:\Users\Admin\AppData\Local\Temp\YX3BKWRYX9UH4TCB1U2YWA0LGU9.exe"
                  4⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3868
                • C:\Users\Admin\AppData\Local\Temp\8SDXS6F5JDUXC9Z24699OENBQ3BYA.exe
                  "C:\Users\Admin\AppData\Local\Temp\8SDXS6F5JDUXC9Z24699OENBQ3BYA.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:3004
              • C:\Users\Admin\AppData\Local\Temp\1016978001\d81aff9a4a.exe
                "C:\Users\Admin\AppData\Local\Temp\1016978001\d81aff9a4a.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:2872
              • C:\Users\Admin\AppData\Local\Temp\1016979001\4942f90f8f.exe
                "C:\Users\Admin\AppData\Local\Temp\1016979001\4942f90f8f.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1596
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3064
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1720
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1848
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:596
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3956
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                    PID:2304
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      5⤵
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:720
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f531ec2a-11ad-492f-9c15-e212b9544dc7} 720 "\\.\pipe\gecko-crash-server-pipe.720" gpu
                        6⤵
                          PID:3296
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bd95dba-ad38-44cf-824b-3d0aac933c90} 720 "\\.\pipe\gecko-crash-server-pipe.720" socket
                          6⤵
                            PID:2212
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2972 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e84b675f-b9b8-4a73-b267-a397a5afc962} 720 "\\.\pipe\gecko-crash-server-pipe.720" tab
                            6⤵
                              PID:2356
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3992 -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3108 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee731add-5ca2-4852-b3cd-71cc2a5f992d} 720 "\\.\pipe\gecko-crash-server-pipe.720" tab
                              6⤵
                                PID:4184
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4836 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2d781b5-afa9-49cc-8073-0d8375d53fa4} 720 "\\.\pipe\gecko-crash-server-pipe.720" utility
                                6⤵
                                • Checks processor information in registry
                                PID:5724
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 3 -isForBrowser -prefsHandle 5724 -prefMapHandle 5732 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f4f4d99-c5f5-4099-858a-b0cfc014b589} 720 "\\.\pipe\gecko-crash-server-pipe.720" tab
                                6⤵
                                  PID:5636
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5800 -prefMapHandle 5796 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17f1ec00-dff9-4de7-86b2-49229a8acb42} 720 "\\.\pipe\gecko-crash-server-pipe.720" tab
                                  6⤵
                                    PID:5644
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 5 -isForBrowser -prefsHandle 5944 -prefMapHandle 5952 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76d4d91f-a11a-471c-b371-0d12e6e5cf58} 720 "\\.\pipe\gecko-crash-server-pipe.720" tab
                                    6⤵
                                      PID:5656
                              • C:\Users\Admin\AppData\Local\Temp\1016980001\b80e2e1ea4.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016980001\b80e2e1ea4.exe"
                                3⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3412
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2452
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2244 -ip 2244
                            1⤵
                              PID:388
                            • C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe
                              C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
                              1⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:4792
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:404
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4932 -ip 4932
                              1⤵
                                PID:4676
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:3168
                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4288
                              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5596
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  2⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5652
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                  2⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5756
                                  • C:\Windows\system32\PING.EXE
                                    "C:\Windows\system32\PING.EXE" 127.1.10.1
                                    3⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:1928

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              2
                              T1546

                              Change Default File Association

                              1
                              T1546.001

                              Component Object Model Hijacking

                              1
                              T1546.015

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              2
                              T1546

                              Change Default File Association

                              1
                              T1546.001

                              Component Object Model Hijacking

                              1
                              T1546.015

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              4
                              T1112

                              Virtualization/Sandbox Evasion

                              3
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              2
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Windows Credential Manager

                              1
                              T1555.004

                              Unsecured Credentials

                              4
                              T1552

                              Credentials In Files

                              4
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              9
                              T1012

                              Remote System Discovery

                              1
                              T1018

                              System Information Discovery

                              5
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Virtualization/Sandbox Evasion

                              3
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              3
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\PROGRA~1\VSREVO~1\REVOUN~1\revoflt.sys
                                Filesize

                                37KB

                                MD5

                                ec8e58e6b58b4fcde77431cda3a24c0e

                                SHA1

                                ebb474009b2a2fbce648adff4b8b797fcd00c997

                                SHA256

                                25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd

                                SHA512

                                e2c667ebe97973ff27c1edf3e45ebf7950bc8d7aad1126da25290a2f590b21808654694cbe6a0ad1d3649566ec7645eb6b3379c7d7c0a650d5381a69e9cdade4

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
                                Filesize

                                187KB

                                MD5

                                8b9964e06195fd375d126b424e236f03

                                SHA1

                                6f1741cfeb9fb70c34857dbba3e063c88c3c32fa

                                SHA256

                                bda04b693bfdea86a7a3b47f2e4ceae9cd9475c4e81b0aa73b70fd244a65f70f

                                SHA512

                                741019523b4c5f4ef9a7952172309b2d304a84cbd98fff99a719105cc1938157edb1691554a21b9dcd2b523c0f1ab0d37879deefc3b2fa5579c0d8c76cade483

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                                Filesize

                                24.2MB

                                MD5

                                c8c368988a2a4c2a953b7db4bca47961

                                SHA1

                                5acc29b51284146a9ff7b1587c3d89416e66acdf

                                SHA256

                                f680e0fe00a48f6e3d079c1572682d6664f476b119745d73cb852baba58cc683

                                SHA512

                                5fdef1f4e3b471910fe2b12f6f6aa8bfad3f2a9c80954843085c79139823a88e0c7d921b7c01dda56871800afc20de4739682c02e9fa6a94715c64207a671b30

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
                                Filesize

                                123KB

                                MD5

                                00d7babcb1fca39669a305acc4e6bc4e

                                SHA1

                                caa71de90128acf6e8d812e02aa8ba4622bf8454

                                SHA256

                                f0f1890de8a60f87297d6de21146977060a3b5d82e09523bced0c238e94f5d2e

                                SHA512

                                9f1348f6ee7325b7d3381865bda4d71807da45c941c3b40c7671df04a6558832dfd03f25f5664250b43b641117d7d3d7c71f7e81b747cbc559fc5b8169033f66

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
                                Filesize

                                132KB

                                MD5

                                0a56b7e703bd3ed03ebaff0d1ce37be1

                                SHA1

                                1629651f20c63bad9b92f7a21f66a095f7ab8fc1

                                SHA256

                                b7727c9c2cedcef3808b677814640e3e4b486517bf66f512c543ef8d0b3a0a21

                                SHA512

                                9dcae642eb17514e87c7798881f501bba75d39f6addfb08f795caa6ad229bade02a16b29a54e718d608778cfbae69ea8f864e61e6908bbc7598b09aaa6ce64e1

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                                Filesize

                                2KB

                                MD5

                                edc78deb34de240c787b1011161e9a4e

                                SHA1

                                2d31275530dce33d3bc329991c8ad59e1b303577

                                SHA256

                                69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b

                                SHA512

                                e55eefcc39b7353ef11a778910400c5c85cab9657bb350840988cbbf556dc343a9c1803442643c9255c149f8d93a5c2d2e6c3bea244f67c895e635eaec0a0f7b

                                Download Submit

                              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                                Filesize

                                9.6MB

                                MD5

                                216b49b7eb7be44d7ed7367f3725285f

                                SHA1

                                cf0776ecbc163c738fd43767bedcc2a67acef423

                                SHA256

                                c6d97857b3b9f26c8e93d7b6e6481f93a16db75cbf9d1756cb29fba0fd9e240e

                                SHA512

                                060fb76d91bee1b421f133cae17726a68adc97ddce76a67196d10e735e216d032bee939c905b847c50f29e859dca43cdf1b19e4ae349e00efe88147224d665cb

                                Download Submit

                              • C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro5.lic
                                Filesize

                                64KB

                                MD5

                                8462a9b69c76a9603a4143d51fbc201e

                                SHA1

                                4473590f93f94f22c340a354516191c3c0ba6532

                                SHA256

                                fe4bcb4251f77375119a936c80fb36221af0c5105e840e2e115d47f96cb437c8

                                SHA512

                                2f02ecdb06760a093f4d8e6f04c97138695b064db8cb2dcc4af9b47c829852f38b77be9425eb2f3e3e36f85da181c116c829921fa35ae68afc57c728d5393570

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
                                Filesize

                                18KB

                                MD5

                                c89cd0e6df2f0301cae37bff6d1cb49d

                                SHA1

                                65b2b40eb80c8c67cacd0e5208f046d23707ff7b

                                SHA256

                                b1280a4f76c1cc8ba0548e553430e729dcd02f86bd66c6f2e477316befea35ac

                                SHA512

                                551368b6bfde2ea51e0d1d2c411f5c9a28e85e082ca995967e32c3881e7815aa84822876adbdcc5b54a3b7f08bf435130172c4008cf1d512e69d60303bc91d8a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                Filesize

                                13KB

                                MD5

                                4717915252f20daaa5b9bc8cf3e5ba73

                                SHA1

                                166b4224d6dc2ff5e1925bdbd16152372c340acc

                                SHA256

                                2d421369436c4d278280796021bd0a39a60e3152ba0af0caedf6289618e01619

                                SHA512

                                b581e7470e7c187fa3fa5d4a43c9b442a9cd216aa20dbb8e0764cfb6607b4d32ead1eaef5b80ddedc0733911eee1aaa17eb7a753df5b068716b240857404162b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                Filesize

                                15KB

                                MD5

                                96c542dec016d9ec1ecc4dddfcbaac66

                                SHA1

                                6199f7648bb744efa58acf7b96fee85d938389e4

                                SHA256

                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                SHA512

                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                                Filesize

                                10.2MB

                                MD5

                                d3b39a6b63c3822be6f8af9b3813bbad

                                SHA1

                                00b020e5a1c05442612f2cec7950c2814b59b1b6

                                SHA256

                                786f1331a0618485b31ba763911b14fcec691bf9897bee8f42680076092b7a2f

                                SHA512

                                a5c7504b29798fdabf610cf65716ec1d7745956f470d86de12a52b3c8731f858764fdf78647e50b3111622e7e65f05f82cd258b98c1a0f45ef7fdc088647d4ff

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007235001\4478ed0a43.exe
                                Filesize

                                2.8MB

                                MD5

                                3bb75cb881e430e48ec13d73d43abe49

                                SHA1

                                dffcad869a875b9fa9a142bedf34d781db72e709

                                SHA256

                                1e632d695c7204f2b42e9ce49001d02c81aad32216b0375f94e710f6190aeb6a

                                SHA512

                                8bfd4b91c00b20e3cbcea3d0c19f80af8813fe5142eb59b30827e3bca0308b70f40754288345fa7b10de49e949792e81f084994e83197d857ef248f8f29d6eeb

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                                Filesize

                                3.1MB

                                MD5

                                c00a67d527ef38dc6f49d0ad7f13b393

                                SHA1

                                7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                                SHA256

                                12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                                SHA512

                                9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                                Filesize

                                17.6MB

                                MD5

                                3c224e3fc892719dc1e302378e533579

                                SHA1

                                0a65062e1426a95bfeca355398b6fdc4912fb6b1

                                SHA256

                                64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

                                SHA512

                                554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016970001\780caea13c.exe
                                Filesize

                                758KB

                                MD5

                                afd936e441bf5cbdb858e96833cc6ed3

                                SHA1

                                3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                SHA256

                                c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                SHA512

                                928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016971001\6b6179fa92.exe
                                Filesize

                                1.9MB

                                MD5

                                e7eb9a61aec1e191dcc006e605c7628e

                                SHA1

                                f931ceab7be44e9efb12b7ff292e0227eadebce2

                                SHA256

                                0428284ddb962526e13dcf1be7707e0ce1acfcca7eba4dc33a03dc8503c03253

                                SHA512

                                73856a2a132ea5786860d07b36bd3293facc0562f2b630a08036932331d1e91417e87753815c25d534fa2eb0f6d76e8039a3af6eb407294711eae5bb0b1a1ba5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016972001\1aec830598.exe
                                Filesize

                                747KB

                                MD5

                                8a9cb17c0224a01bd34b46495983c50a

                                SHA1

                                00296ea6a56f6e10a0f1450a20c5fb329b8856c1

                                SHA256

                                3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

                                SHA512

                                1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016973001\5bc9625dd1.exe
                                Filesize

                                4.2MB

                                MD5

                                3a425626cbd40345f5b8dddd6b2b9efa

                                SHA1

                                7b50e108e293e54c15dce816552356f424eea97a

                                SHA256

                                ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                SHA512

                                a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016974001\b283605cfc.exe
                                Filesize

                                2.9MB

                                MD5

                                53794ed30f84817a4fba9b4ab9e0d9f5

                                SHA1

                                37ac4bc007e07ab6ce504af155178e72fd209f31

                                SHA256

                                1a0bbe3b41111bf13db81281111de188157cb55fa35097b7a541254a3da1b361

                                SHA512

                                855a6cc5170a57652e778574a34f2bb952961da8921b78030f98b19818a2ff81b4b1e571fde36176a796ae2654dc066ee2137808d5158e4980445f0e023fd54d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016975001\f05b4c5daa.exe
                                Filesize

                                4.2MB

                                MD5

                                8841698b335573b0abe7875b85b653d6

                                SHA1

                                e74926dcb5b7e996d4f4961a763d2c4d8e8e24d0

                                SHA256

                                490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b

                                SHA512

                                2f8941aaf2724687e70f4c742ac2f3a2009df18776d8e182a3042eb33422463df109e1e666d8f8a66cd7f6312e86aa9dd4a127c5559e04cbd57a6da51077e037

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016977001\6cc50f9433.exe
                                Filesize

                                1.8MB

                                MD5

                                6a31ef4963e7f7d4fcc0927f58a5dbf2

                                SHA1

                                08180799961431fd8fbe0e32c1147d560ab258ad

                                SHA256

                                e0bb02c3593df3fb9b89b57840abf4c80dc7a3951efe4804c23feb13f3e1c34a

                                SHA512

                                4a796c9d2dc9c16f471d51e68c5e50ba40a179444a1ecf7beaaeb823bf46b973ea6ca4a421d899aabc7a1ee331832c654d788882627bbb4ec77340ee87f7169b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016979001\4942f90f8f.exe
                                Filesize

                                945KB

                                MD5

                                4e38b1008d236084740a6c44fbc4ebf6

                                SHA1

                                fc8bd7f661e78127932bf4f0fed8651044c3ec28

                                SHA256

                                d18ee20816febb7f9c68c906651376a94130383b54cc739aa9cbe55a9c4659bf

                                SHA512

                                e5d0445f8c1de74a66934f4e21784fd4ab2d7bbe05047a5c2d826a3aaba8047f76cb084bec23bb7a243d68fcee72310541aafde2818b84edf703d59dae93ef7e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1016980001\b80e2e1ea4.exe
                                Filesize

                                1.7MB

                                MD5

                                7be93aff7cef5ad80c82706349b7fed3

                                SHA1

                                3ecee88fe03d1128fdd9687aadfefbc30422881e

                                SHA256

                                03758fcdba856326a849effda02aa9185ab135b95c1c0854e9ec7d2d3889c0f3

                                SHA512

                                7d620e39f4d1498765f733078c41f2db5c5f273e2e8781bfc517aee9d444bd6cbba817f0c925a95c2acb76f6f4467fa56a8306f6d372e321e7e1c69495a25db0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
                                Filesize

                                15.0MB

                                MD5

                                00fad648745710b9c4d16c4830416d80

                                SHA1

                                fafb219fe26e065cc11d4c12a4960447509b2a84

                                SHA256

                                e4561ffd0993938234d207ce56d5fe775c4ddb704f7be63003026d43eae0a337

                                SHA512

                                21e7b3965d1f54eb671b46e272161a426dd8a4151208b154c7fbf144725c38d593d513fb6f77cd1cef4df651266fc235a76023102b5fdc85cc8cc67da6ded847

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tuw5ti4g.hjr.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                Filesize

                                2.9MB

                                MD5

                                17773f6ab422d27012d0f813eec77035

                                SHA1

                                e148f243044c22dd5374d41d4d9c5ae066c454cf

                                SHA256

                                34b764f92f6aa319f62bf730e82f02a914cda5c7d7fa665c20a8f2c5430acc4a

                                SHA512

                                6e0f75cea50dd43eb019fa5eb66d7e92262b2a7fdc12ab872afbd6339c069856427ce0e7cfd86fcbf17943d7c180a15ce12a9799561330173f485cafaa4ace88

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\Installer.png
                                Filesize

                                41KB

                                MD5

                                48f30e9b874607f974a289c4b9366eac

                                SHA1

                                665bc7dd97777c2b28034b4fe9e67aef918638e6

                                SHA256

                                36fc3878d46bb626808d005d048b06e047f099ea55e06630e5ca3f770e9d2001

                                SHA512

                                b6920c6a3eb231cc7c4ec856f4c1c4244c81828ac8ef755f396d327a9e41c3f26fdea8c7f8ae1df8d9d48dd7840090bb19bcb2f653f84b958cb84cd6e901cc65

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\Server.png
                                Filesize

                                51KB

                                MD5

                                e5064949166150e855113e66df1abc38

                                SHA1

                                d24f57301f4d4f3b48081e4c8744e9fc031676f7

                                SHA256

                                e73cf0ce497baf7d5b8180143b91a2f42de1d87480cf3f38271f0f2f97aa4080

                                SHA512

                                fc3749f2453d8eb7e9b9dc325951543c1640ca1d15ee547c9da117451a10fa5e1605b3a7e783558291ed67d460a712aed938a07681e99a1f203d5f14ae081086

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\_isetup\_RegDLL.tmp
                                Filesize

                                4KB

                                MD5

                                0ee914c6f0bb93996c75941e1ad629c6

                                SHA1

                                12e2cb05506ee3e82046c41510f39a258a5e5549

                                SHA256

                                4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2

                                SHA512

                                a899519e78125c69dc40f7e371310516cf8faa69e3b3ff747e0ddf461f34e50a9ff331ab53b4d07bb45465039e8eba2ee4684b3ee56987977ae8c7721751f5f9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\_isetup\_setup64.tmp
                                Filesize

                                6KB

                                MD5

                                4ff75f505fddcc6a9ae62216446205d9

                                SHA1

                                efe32d504ce72f32e92dcf01aa2752b04d81a342

                                SHA256

                                a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81

                                SHA512

                                ba0469851438212d19906d6da8c4ae95ff1c0711a095d9f21f13530a6b8b21c3acbb0ff55edb8a35b41c1a9a342f5d3421c00ba395bc13bb1ef5902b979ce824

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\_isetup\_shfoldr.dll
                                Filesize

                                22KB

                                MD5

                                92dc6ef532fbb4a5c3201469a5b5eb63

                                SHA1

                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                SHA256

                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                SHA512

                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\b2p.dll
                                Filesize

                                22KB

                                MD5

                                ab35386487b343e3e82dbd2671ff9dab

                                SHA1

                                03591d07aea3309b631a7d3a6e20a92653e199b8

                                SHA256

                                c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2

                                SHA512

                                b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\botva2.dll
                                Filesize

                                37KB

                                MD5

                                67965a5957a61867d661f05ae1f4773e

                                SHA1

                                f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                SHA256

                                450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                SHA512

                                c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\eng.png
                                Filesize

                                4KB

                                MD5

                                86bee4a15a777e236f1636b57a37b047

                                SHA1

                                7c93de14c61603a0573719de1ffa86b7226c0dae

                                SHA256

                                17e6f0e88a231e25c1de67a0d4ae308284f407dea77ff8b3ce363b770c5ba8f1

                                SHA512

                                af3ebe043048c6dc683408f22e647609d0423fd2fa55cba5d981f978fb1123fd9d5cfca147168d4ff437a09f699fd5d5c1a14b50d66ed4bcae4485adcf0ab8b7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\icon.png
                                Filesize

                                4KB

                                MD5

                                f5486535c71cd199e6c1f3dc43a8943e

                                SHA1

                                366a454cfab4821747d069c2c5de687b84e49323

                                SHA256

                                ee5c535dc8f819b31346e1723db1a5aab6bda94ff57c2477e1291fd4f7841bb8

                                SHA512

                                ab2bf66480260064075e655746eabd32ea71e1f9b232c03ecb67999825418177c033b224b0f5f5b269d1b86428134e6bf7389c1729a591103d4b74b7497e67b1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\iswin7logo.dll
                                Filesize

                                39KB

                                MD5

                                1ea948aad25ddd347d9b80bef6df9779

                                SHA1

                                0be971e67a6c3b1297e572d97c14f74b05dafed3

                                SHA256

                                30eb67bdd71d3a359819a72990029269672d52f597a2d1084d838caae91a6488

                                SHA512

                                f2cc5dce9754622f5a40c1ca20b4f00ac01197b8401fd4bd888bfdd296a43ca91a3ca261d0e9e01ee51591666d2852e34cee80badadcb77511b8a7ae72630545

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-79R4O.tmp\rus.png
                                Filesize

                                2KB

                                MD5

                                6e57cda7a4a20382c6033d2458bd676c

                                SHA1

                                5524b66fa844db104ce6173f7aa0de625f53a408

                                SHA256

                                2b9fb591c534ff41765b9b4eaee88e121501b78cb3bce3bd768c68838a363e5b

                                SHA512

                                f33de6f8897e9a756a2d3c86fdb75549b475e7185a8aa4b8d1462a59e2eedc8b48d2acfbef4347584ba23d71cd7aeb0856e737c07f4f82379aab40fe6860974a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-BGUTO.tmp\NordVPNSetup.tmp
                                Filesize

                                920KB

                                MD5

                                ce14f23d9bfc00a3cc5ceb06a25030e7

                                SHA1

                                c63991558fb7c45555a1c4e53151bdb518b15eec

                                SHA256

                                5bd02d57433581efc6e14f6aefa4d1b5a52051f2ca269bde439b50658fa0bc39

                                SHA512

                                6497e85f1009b26fe68317a695467505e6f75270f07308ee7c321abe9b08b7ae563598b11b44629051759f321a39ec7595c0c6e48b9778146ee7f42096ff88ce

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                                Filesize

                                1.6MB

                                MD5

                                72491c7b87a7c2dd350b727444f13bb4

                                SHA1

                                1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                SHA256

                                34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                SHA512

                                583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                Filesize

                                458KB

                                MD5

                                619f7135621b50fd1900ff24aade1524

                                SHA1

                                6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                SHA256

                                344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                SHA512

                                2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                                Filesize

                                3.3MB

                                MD5

                                045b0a3d5be6f10ddf19ae6d92dfdd70

                                SHA1

                                0387715b6681d7097d372cd0005b664f76c933c7

                                SHA256

                                94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                                SHA512

                                58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                Filesize

                                440B

                                MD5

                                3626532127e3066df98e34c3d56a1869

                                SHA1

                                5fa7102f02615afde4efd4ed091744e842c63f78

                                SHA256

                                2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                SHA512

                                dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\VS Revo Group\Revo Uninstaller Pro\logFile.vslog
                                Filesize

                                322B

                                MD5

                                c48177f47ead4a67096772f5c605d97b

                                SHA1

                                b165d1c381dd4d6e7a571b656189ebc9c559a74f

                                SHA256

                                084ad149c373202b9ab5b8da2eea861b02420b8927c7500acfe38d4f6c084324

                                SHA512

                                6c8d2b667bc1d75b4061dd41f43449561ea0f70957778ac908eb129d5073ad0604bd1c92650e750401bd6da175f819e4c9800b4a6442431d1f9eea3d3b6aec55

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                                Filesize

                                8KB

                                MD5

                                e1f8c30588ab3545e2ed67f46afe04dc

                                SHA1

                                a2b2b69e80e68a83c8af9ae4c004b942a675aebe

                                SHA256

                                966983b6bf6ea330c2071399e214f43fd0852e1c3a2af1e6d6ab448466967f05

                                SHA512

                                2817a989c7c60afba501dda1a8cbf24d800082f87f3953cd3aaa2ea7c51c4dbb75f339d6f45c925cd892683209d9ce2a2b7160ee9124fa62677cb7b3f10e6595

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                                Filesize

                                6KB

                                MD5

                                7f368492ee1391c6b52c06c06080c0af

                                SHA1

                                a2b3f51ef1256a21b122c02bdfa16e430114301d

                                SHA256

                                5a2c464f0a19919341ad60769c4c7e035166bf4f838a9f57ba8704a6f3cca0c0

                                SHA512

                                ac5d4daf362926d115ce6a8de05d79d6ae3e757435342a909cf9e853e6a4812b3ef066084f6e7097db9e7f8d061b18bcd3070d05368d4fe2a7692652c173442c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                96fa1a00e777a23825a1ca98ef7de20c

                                SHA1

                                9082a1c1decc88023a8d61e49d7381dfd3491b8a

                                SHA256

                                1599f591bc77e13de4228868a66f6410e6b5bbba6fe9b753a8f45252edd3b18c

                                SHA512

                                3581d7b92613615c03fcaa2d0fb90bf156e22c433a5ea0a9fbd0d2399294e154e2ecc549f432479473647d3facdcac73bccd429aadd24449d0d92f963c6319c9

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                43267937ed4d8d29b8aa2e09f0384786

                                SHA1

                                29c85e5aef75068d94cdd22482d21add7d983b4b

                                SHA256

                                b98b9610e2d74ce8fef5652d3bc312906c7b764c951e9b130caf9f00808b8370

                                SHA512

                                71dccca94b5f8dbb8361b1b519f42a2bde3e113e5717e190e25af9c6f817a5fe868057c1b3589fd2021a8f93ce5391e987e0150b748811d4f07e6ce93fb423f6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                5KB

                                MD5

                                ab9cd55a9b8fe15511c6f977831439d5

                                SHA1

                                e637e78a44b4e107759667bfc83c288288c04bd7

                                SHA256

                                8d464d1a56250bf5af57092c5c84af3df908dfb85f850dc07a7efe652573028a

                                SHA512

                                b5508bff04ae672fdb19f14689b1b5ec3679efedafff3e5b50560eeef2b8faeaac184ceb532173d828bbfb0f0b1e46ee22538c0af33d083bf9c4ee271e37e2dd

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\62c2d8ee-99b7-4f41-bfc7-cb47a6603f15
                                Filesize

                                671B

                                MD5

                                e1587295b733a839afbc2132329ada9f

                                SHA1

                                19127b01806358d67d5e318a92f316dd9e0e03b8

                                SHA256

                                ada27965e19f172621132fb7cb285bc9bfa1d3e32e3d279882fcd656d2f6f5af

                                SHA512

                                61dfb8de9564f52627608b8d22a56203349e6b2b868205315a5c3a093b0859befd39315df0732e6b2a905bc09945b386661847b83e900de03c8c995dd6b4c99f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\91634f47-c5bc-43da-aa50-593b4a3b86ec
                                Filesize

                                28KB

                                MD5

                                0f711ca0ece2005dde532a457bccc3a3

                                SHA1

                                db4ae538d18201ea5ee28720030361f5bae96dbf

                                SHA256

                                5188c8e901eaa37e6ba405ce2b65b5cd75ccd9003d22e66994107e22b7dd6ed0

                                SHA512

                                f73ec6578a4c13e94943b099a4c4de77aa52fc7d31c370784289a5243a8737c1c448de2a7867af78a7abdf979db76d6e3f6525a8bfeb079a499a5d1779a38d6f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\f231a83b-3c37-404e-a58c-a1a86fce7683
                                Filesize

                                982B

                                MD5

                                9b5a3f59afb853b1d82dcea30081e2ae

                                SHA1

                                2701c2dc2d32370f48a2c2dd072af67d215ef4d6

                                SHA256

                                60e5d0fe0ccf14e7d5876206786375593bf74f1b7b35342fa47033a5eea264da

                                SHA512

                                d8c15c40a506288c1c1dd6f473a354218e525bb7a5b6637248986f9d11351b7933a47c655de050b09352cd912cf70e5b36ea21c9c984bff9eea0fe39061e3b6e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                                Filesize

                                12KB

                                MD5

                                505477ad79e99166ccb5ac30d380bc6e

                                SHA1

                                874e0aa3b6d8a7d5319b72c87bb8e22928fd566b

                                SHA256

                                cec61834e9ce8de4c23bca2531fe2b51d1691f01c48b6932cf51847952e9d169

                                SHA512

                                b57ce41122474fc658bef935a8a7c2be1962eaccfa7d20f6755572fe19fc3ea5df0ee6ae67d2d260efba4577c88317467de2a4dcb2848643b1ee1d18bd4ab156

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                02840eef96769fc29fba05c2e412250d

                                SHA1

                                a33d29eef1c5320025612f908df1caff884196b3

                                SHA256

                                4a9d7387ff4a40a35fdb1a5f5f3f879ca19210c37ea149008a721a0415c7692e

                                SHA512

                                1229216448da07d589bff0d668f5b7e95120b877e972b51a97b9bf7843b61424c7fd046c0de7886cf52120804c45dad450853285523c96ca885fa35b1f3aebdb

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                62752702b443a562a75bdeb4eba73048

                                SHA1

                                29fcaf1375a89ea3204c212b36b0cfb22e51e101

                                SHA256

                                851e35e46d19f46ba3dbbb13a592987cbcf14a274f7bd0fe084738e7bcb3eedf

                                SHA512

                                b93d9dea2d090dc0f69bea6c77c46f6cb626e87c7e6653b334647b0f4946edaeff9f816773afa4e69c2754e9db679270bf5df9f3655f330d8b11bf1426bef8f9

                                Download Submit

                              • memory/404-447-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/452-111-0x000000006FF50000-0x000000006FF6B000-memory.dmp

                                Filesize

                                108KB

                                Download

                              • memory/452-150-0x0000000009700000-0x000000000970F000-memory.dmp

                                Filesize

                                60KB

                                Download

                              • memory/452-146-0x000000006FB70000-0x000000006FB81000-memory.dmp

                                Filesize

                                68KB

                                Download

                              • memory/588-731-0x0000000000A10000-0x0000000000EA9000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/588-778-0x0000000000A10000-0x0000000000EA9000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/896-1206-0x0000000005C70000-0x0000000005C92000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/936-1-0x0000000077394000-0x0000000077396000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/936-2-0x00000000004D1000-0x00000000004FF000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/936-3-0x00000000004D0000-0x00000000007F3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/936-4-0x00000000004D0000-0x00000000007F3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/936-18-0x00000000004D0000-0x00000000007F3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/936-0-0x00000000004D0000-0x00000000007F3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-47-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-52-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-21-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-16-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-20-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-22-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-53-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-19-0x0000000000BD1000-0x0000000000BFF000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1576-44-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-45-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-46-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1576-180-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/1736-733-0x0000000000AF0000-0x0000000001643000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/1736-725-0x0000000000AF0000-0x0000000001643000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/2040-496-0x00007FF67BC50000-0x00007FF67C0E0000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/2040-493-0x00007FF67BC50000-0x00007FF67C0E0000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/2244-344-0x0000000000390000-0x0000000000860000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2244-235-0x0000000000390000-0x0000000000860000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2268-710-0x00000000005E0000-0x0000000000903000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2268-701-0x00000000005E0000-0x0000000000903000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2452-50-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2452-51-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2712-551-0x00000000006D0000-0x00000000009EC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2712-536-0x00000000006D0000-0x00000000009EC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2872-748-0x0000000000C70000-0x000000000116B000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/2872-750-0x0000000000C70000-0x000000000116B000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/3004-780-0x0000000000DA0000-0x000000000129B000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/3004-777-0x0000000000DA0000-0x000000000129B000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/3168-1205-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3168-1200-0x0000000000BD0000-0x0000000000EF3000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3208-552-0x0000000000650000-0x00000000011A3000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/3208-686-0x0000000000650000-0x00000000011A3000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/3208-752-0x0000000000650000-0x00000000011A3000-memory.dmp

                                Filesize

                                11.3MB

                                Download

                              • memory/3256-112-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-104-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-79-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-162-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-164-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-158-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-181-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-183-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-184-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-187-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-69-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-86-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-85-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-194-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-84-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-81-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-80-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-78-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-115-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-99-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-100-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-103-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-106-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-113-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-101-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-102-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-82-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3256-105-0x0000000004330000-0x000000000457F000-memory.dmp

                                Filesize

                                2.3MB

                                Download

                              • memory/3412-1187-0x0000000000920000-0x0000000000D78000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3412-805-0x0000000000920000-0x0000000000D78000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3412-798-0x0000000000920000-0x0000000000D78000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3412-806-0x0000000000920000-0x0000000000D78000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3412-1190-0x0000000000920000-0x0000000000D78000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3756-497-0x00000221D7CC0000-0x00000221D7CE2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/3772-161-0x0000000000400000-0x0000000000456000-memory.dmp

                                Filesize

                                344KB

                                Download

                              • memory/3772-159-0x0000000000400000-0x0000000000456000-memory.dmp

                                Filesize

                                344KB

                                Download

                              • memory/3868-1173-0x0000000000600000-0x0000000000A58000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3868-1179-0x0000000000600000-0x0000000000A58000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3868-772-0x0000000000600000-0x0000000000A58000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3868-773-0x0000000000600000-0x0000000000A58000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3868-771-0x0000000000600000-0x0000000000A58000-memory.dmp

                                Filesize

                                4.3MB

                                Download

                              • memory/3928-88-0x0000000000400000-0x0000000000419000-memory.dmp

                                Filesize

                                100KB

                                Download

                              • memory/4288-1201-0x00000000006D0000-0x00000000009EC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4288-1203-0x00000000006D0000-0x00000000009EC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4752-637-0x00000000009E0000-0x0000000000EDB000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/4752-655-0x00000000009E0000-0x0000000000EDB000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/4864-535-0x00000000006C0000-0x00000000009DC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4864-524-0x00000000006C0000-0x00000000009DC000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4932-684-0x0000000000ED0000-0x00000000013A0000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4932-653-0x0000000000ED0000-0x00000000013A0000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/5084-41-0x0000000072FAE000-0x0000000072FAF000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/5084-155-0x0000000005380000-0x00000000053A2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/5084-42-0x00000000007E0000-0x0000000000B08000-memory.dmp

                                Filesize

                                3.2MB

                                Download

                              • memory/5084-43-0x00000000053D0000-0x000000000546C000-memory.dmp

                                Filesize

                                624KB

                                Download

                              • memory/5084-147-0x0000000005640000-0x0000000005796000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/5084-48-0x0000000072FAE000-0x0000000072FAF000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/5084-152-0x0000000005E50000-0x00000000063F4000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/5596-1210-0x00007FF73C150000-0x00007FF73C5E0000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/5596-1224-0x00007FF73C150000-0x00007FF73C5E0000-memory.dmp

                                Filesize

                                4.6MB

                                Download