Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2024 01:09

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    744e8a3718a8bccb6c0bfe243c7ac195

  • SHA1

    06ad06e208965913a03307439e68f1168027fb89

  • SHA256

    9c41a2f71bf50c12c268e61147794c07e5a65642cd2a08235f5dce0ad0cdbc63

  • SHA512

    66802302b003b51072a4eba3b81dd4728f88d642a5813d57e402fd4ab23b4f0f6f07f6812380b6c5bc42818c6a6efc32654405c96253befd023c1b26d5286273

  • SSDEEP

    49152:DUEL8aWXxxR4zmtHbaTpanQ6A3tOhbDgF5yx3G9RGpelk1+a:DUE4aWXfR4CtHbaTpanQV3UVgF5W3BE

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Extracted

Family

cryptbot

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 39 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 63 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1220
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Users\Admin\AppData\Local\Temp\1018024001\cd4ff83cfc.exe
            "C:\Users\Admin\AppData\Local\Temp\1018024001\cd4ff83cfc.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2672
          • C:\Users\Admin\AppData\Local\Temp\1018058001\616c6a6fe5.exe
            "C:\Users\Admin\AppData\Local\Temp\1018058001\616c6a6fe5.exe"
            4⤵
            • Executes dropped EXE
            PID:560
          • C:\Users\Admin\AppData\Local\Temp\1018059001\3c31bb53d6.exe
            "C:\Users\Admin\AppData\Local\Temp\1018059001\3c31bb53d6.exe"
            4⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2256
          • C:\Users\Admin\AppData\Local\Temp\1018060001\1b3128729e.exe
            "C:\Users\Admin\AppData\Local\Temp\1018060001\1b3128729e.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1268
          • C:\Users\Admin\AppData\Local\Temp\1018061001\17c0be04ca.exe
            "C:\Users\Admin\AppData\Local\Temp\1018061001\17c0be04ca.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:1596
          • C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe
            "C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
            • C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe
              "C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"
              5⤵
              • Executes dropped EXE
              PID:3060
            • C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe
              "C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:272
          • C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe
            "C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2360
            • C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe
              "C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1012
          • C:\Users\Admin\AppData\Local\Temp\1018064001\477c0509ba.exe
            "C:\Users\Admin\AppData\Local\Temp\1018064001\477c0509ba.exe"
            4⤵
            • Executes dropped EXE
            PID:1776
          • C:\Users\Admin\AppData\Local\Temp\1018065001\69c3a4d93a.exe
            "C:\Users\Admin\AppData\Local\Temp\1018065001\69c3a4d93a.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\cquuy"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1888
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2280
          • C:\Users\Admin\AppData\Local\Temp\1018066001\4e6c5211b6.exe
            "C:\Users\Admin\AppData\Local\Temp\1018066001\4e6c5211b6.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1104
          • C:\Users\Admin\AppData\Local\Temp\1018067001\81bc274c20.exe
            "C:\Users\Admin\AppData\Local\Temp\1018067001\81bc274c20.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:2692
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
              5⤵
              • Uses browser remote debugging
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:3160
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6de9758,0x7fef6de9768,0x7fef6de9778
                6⤵
                  PID:3184
                • C:\Windows\system32\ctfmon.exe
                  ctfmon.exe
                  6⤵
                    PID:3456
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:2
                    6⤵
                      PID:3612
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:8
                      6⤵
                        PID:3652
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:8
                        6⤵
                          PID:3768
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:4668
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2480 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:4948
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2488 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:1
                          6⤵
                          • Uses browser remote debugging
                          PID:5048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1232,i,15152715907494554798,1327029897823988437,131072 /prefetch:2
                          6⤵
                            PID:7920
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                          5⤵
                          • Uses browser remote debugging
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:2080
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5319758,0x7fef5319768,0x7fef5319778
                            6⤵
                              PID:2856
                            • C:\Windows\system32\ctfmon.exe
                              ctfmon.exe
                              6⤵
                                PID:2408
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:2
                                6⤵
                                  PID:2096
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:8
                                  6⤵
                                    PID:3120
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:8
                                    6⤵
                                      PID:3156
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:1
                                      6⤵
                                      • Uses browser remote debugging
                                      PID:3480
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2540 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:1
                                      6⤵
                                      • Uses browser remote debugging
                                      PID:2156
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2528 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:1
                                      6⤵
                                      • Uses browser remote debugging
                                      PID:4116
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=148 --field-trial-handle=1216,i,11440531226624054932,11427921038923095003,131072 /prefetch:2
                                      6⤵
                                        PID:4604
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\CBAFIDAECB.exe"
                                      5⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:8404
                                      • C:\Users\Admin\Documents\CBAFIDAECB.exe
                                        "C:\Users\Admin\Documents\CBAFIDAECB.exe"
                                        6⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:8440
                                  • C:\Users\Admin\AppData\Local\Temp\1018068001\b24d56b4d9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1018068001\b24d56b4d9.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:2224
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /F /IM firefox.exe /T
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1692
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /F /IM chrome.exe /T
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:7672
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /F /IM msedge.exe /T
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:7952
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /F /IM opera.exe /T
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:8048
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /F /IM brave.exe /T
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:8152
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                      5⤵
                                        PID:8244
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                          6⤵
                                          • Checks processor information in registry
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:8260
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.0.1721961944\767368503" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f25ada5f-7b64-4ad3-96de-339455bde6f4} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 1284 120d5b58 gpu
                                            7⤵
                                              PID:8656
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.1.68233821\1431001318" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a892beb5-436e-48e4-8770-34061d40b046} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 1500 d74b58 socket
                                              7⤵
                                                PID:8792
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.2.892931038\980113445" -childID 1 -isForBrowser -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c3268d-b369-4e06-9a52-2c387f787eca} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 2116 1a6be258 tab
                                                7⤵
                                                  PID:9372
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.3.978749333\1540817521" -childID 2 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4ed976-ceb8-45d7-84fb-3656f0c90e15} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 2916 d63058 tab
                                                  7⤵
                                                    PID:9924
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.4.1935841042\427895205" -childID 3 -isForBrowser -prefsHandle 3744 -prefMapHandle 3740 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6291dccb-a44d-48ff-8f99-c3ee2fee82bf} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 3756 20f38558 tab
                                                    7⤵
                                                      PID:5160
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.5.565087384\365174552" -childID 4 -isForBrowser -prefsHandle 3864 -prefMapHandle 3868 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cecf3b8-49cd-421f-97d7-6888ee3de8b3} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 3852 20f9bf58 tab
                                                      7⤵
                                                        PID:5324
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8260.6.2134589127\131364990" -childID 5 -isForBrowser -prefsHandle 4040 -prefMapHandle 4044 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97856ac6-2839-4106-90a5-ac908724852c} 8260 "\\.\pipe\gecko-crash-server-pipe.8260" 4028 20f99558 tab
                                                        7⤵
                                                          PID:5844
                                                  • C:\Users\Admin\AppData\Local\Temp\1018069001\0200dc27b8.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1018069001\0200dc27b8.exe"
                                                    4⤵
                                                    • Modifies Windows Defender Real-time Protection settings
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Windows security modification
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1972
                                                  • C:\Users\Admin\AppData\Local\Temp\1018070001\35cca5c170.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1018070001\35cca5c170.exe"
                                                    4⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Loads dropped DLL
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4836
                                                  • C:\Users\Admin\AppData\Local\Temp\1018071001\9a9afce362.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1018071001\9a9afce362.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5724
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                                                      5⤵
                                                      • Loads dropped DLL
                                                      PID:6060
                                                      • C:\Windows\system32\mode.com
                                                        mode 65,10
                                                        6⤵
                                                          PID:6104
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6120
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_7.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6176
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_6.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6236
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_5.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6284
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_4.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6332
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_3.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6376
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_2.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6416
                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                          7z.exe e extracted/file_1.zip -oextracted
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6464
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib +H "in.exe"
                                                          6⤵
                                                          • Views/modifies file attributes
                                                          PID:6512
                                                        • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                                          "in.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:6524
                                                          • C:\Windows\system32\attrib.exe
                                                            attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                            7⤵
                                                            • Views/modifies file attributes
                                                            PID:6548
                                                          • C:\Windows\system32\attrib.exe
                                                            attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                            7⤵
                                                            • Views/modifies file attributes
                                                            PID:6564
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                                            7⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:6612
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell ping 127.0.0.1; del in.exe
                                                            7⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6628
                                                            • C:\Windows\system32\PING.EXE
                                                              "C:\Windows\system32\PING.EXE" 127.0.0.1
                                                              8⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:6832
                                                    • C:\Users\Admin\AppData\Local\Temp\1018072001\616e3ded96.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1018072001\616e3ded96.exe"
                                                      4⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:7120
                                                    • C:\Users\Admin\AppData\Local\Temp\1018073001\6f1d33df34.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1018073001\6f1d33df34.exe"
                                                      4⤵
                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:7760
                                                    • C:\Users\Admin\AppData\Local\Temp\1018074001\4c2179552a.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1018074001\4c2179552a.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:8256
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "powershell.exe" Add-MpPreference -ExclusionPath "C:\uewoyws"
                                                        5⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:8708
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                                                        5⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:8848
                                                    • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:9208
                                                      • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4188
                                                      • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4048
                                                      • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4272
                                                      • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4308
                                                      • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4512
                                                • C:\Windows\SysWOW64\dialer.exe
                                                  "C:\Windows\system32\dialer.exe"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:8052
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:2876
                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                  1⤵
                                                    PID:3932
                                                  • C:\Windows\system32\taskeng.exe
                                                    taskeng.exe {9E01D8C9-A7EB-438A-8984-A115883AEC81} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
                                                    1⤵
                                                    • Loads dropped DLL
                                                    PID:2260
                                                    • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                      C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:1984
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        3⤵
                                                          PID:2264
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                          3⤵
                                                          • Drops file in System32 directory
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          PID:2500
                                                          • C:\Windows\system32\PING.EXE
                                                            "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                            4⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:3048

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      40B

                                                      MD5

                                                      44691fdf709576c5467bd86b9d95cecb

                                                      SHA1

                                                      9c0e49c662f20cdd89217f1bb4b4ba701e659697

                                                      SHA256

                                                      bbeef7deae86cbdb634c26982101647e319bb03dce941d124f0ab0edc8a76de9

                                                      SHA512

                                                      e52fb7f7091ed7a21944c629081fa5069f47fc076911101e20fdcc183c35b7b460fbbfac56f1f91052b1d35a35e66ce2dafce70349ed34ca6f16ba1e1f1fabdf

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

                                                      Filesize

                                                      16B

                                                      MD5

                                                      18e723571b00fb1694a3bad6c78e4054

                                                      SHA1

                                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                      SHA256

                                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                      SHA512

                                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                      Filesize

                                                      264KB

                                                      MD5

                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                      SHA1

                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                      SHA256

                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                      SHA512

                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001

                                                      Filesize

                                                      41B

                                                      MD5

                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                      SHA1

                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                      SHA256

                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                      SHA512

                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp

                                                      Filesize

                                                      16B

                                                      MD5

                                                      206702161f94c5cd39fadd03f4014d98

                                                      SHA1

                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                      SHA256

                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                      SHA512

                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf781101.TMP

                                                      Filesize

                                                      16B

                                                      MD5

                                                      46295cac801e5d4857d09837238a6394

                                                      SHA1

                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                      SHA256

                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                      SHA512

                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                      Filesize

                                                      86B

                                                      MD5

                                                      961e3604f228b0d10541ebf921500c86

                                                      SHA1

                                                      6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                      SHA256

                                                      f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                      SHA512

                                                      535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\download[1].htm

                                                      Filesize

                                                      1B

                                                      MD5

                                                      cfcd208495d565ef66e7dff9f98764da

                                                      SHA1

                                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                      SHA256

                                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                      SHA512

                                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp

                                                      Filesize

                                                      31KB

                                                      MD5

                                                      1406d39146191c18c7314fe0ddef485b

                                                      SHA1

                                                      59a974c74514223bf378732396da85e924197a33

                                                      SHA256

                                                      519077f80fd5ec3ca1d18f96f7d47e118d5921561639d4eac7dcc65b9b41889e

                                                      SHA512

                                                      1ece74d4b64602fc9fbc2a9a9331b23b598d00f47f0e5adb11487e4a0aa68d7e4b58575b1d018c28445a2133ddb6fcf65688cef12ee4e3065313df438d5a4e55

                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      96c542dec016d9ec1ecc4dddfcbaac66

                                                      SHA1

                                                      6199f7648bb744efa58acf7b96fee85d938389e4

                                                      SHA256

                                                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                      SHA512

                                                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                    • C:\Users\Admin\AppData\Local\Temp\1018024001\cd4ff83cfc.exe

                                                      Filesize

                                                      2.8MB

                                                      MD5

                                                      54bd0a4a6832cd8741dd5fc5f0daf5a6

                                                      SHA1

                                                      f26f87b42fdf58061417d60eb1f88ea831170f5d

                                                      SHA256

                                                      ab3c146bcd1ac658f3655aa9b5a862ec2b47811729b69fad46856e31a6e74747

                                                      SHA512

                                                      9c80905c436ce23840be805222778f6a0332c768fb105ac63e11b8ebbb2f4330ac7630611d9ed5f7dc32fa70f1dbd3c6ecc7faf5f728d496102e1d96c5ce2cb9

                                                    • C:\Users\Admin\AppData\Local\Temp\1018058001\616c6a6fe5.exe

                                                      Filesize

                                                      758KB

                                                      MD5

                                                      afd936e441bf5cbdb858e96833cc6ed3

                                                      SHA1

                                                      3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                                      SHA256

                                                      c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                                      SHA512

                                                      928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                                    • C:\Users\Admin\AppData\Local\Temp\1018059001\3c31bb53d6.exe

                                                      Filesize

                                                      4.2MB

                                                      MD5

                                                      8664a5a6e958f985735b8a17171550bc

                                                      SHA1

                                                      3deb8bfcdc32ddf9a678f44c59aa70e3a7f5bb5f

                                                      SHA256

                                                      ffcc7288342a28c0580bea142951bf4ac33a3f391d8f9323f9e74293d2817e82

                                                      SHA512

                                                      adc1c9bc3af3a39b066a9231ef6bd9119d48dff41a4e5bfac695c40a5d2b9e5e9f4eb6e4779408cd7f22fe0e7e5697d7fa314778864fd13bb321db3f8d0514b0

                                                    • C:\Users\Admin\AppData\Local\Temp\1018060001\1b3128729e.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      25fb9c54265bbacc7a055174479f0b70

                                                      SHA1

                                                      4af069a2ec874703a7e29023d23a1ada491b584e

                                                      SHA256

                                                      552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                                                      SHA512

                                                      7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                                                    • C:\Users\Admin\AppData\Local\Temp\1018061001\17c0be04ca.exe

                                                      Filesize

                                                      4.3MB

                                                      MD5

                                                      98f2f2f0d74571af72dd4ca43c1692bf

                                                      SHA1

                                                      507cac98014412c6e697ea75f3c1941bad57df48

                                                      SHA256

                                                      dfe46285484362af5dc63dd0bba5de89c1c1d7105f7e8d05b2514fa39ac3750a

                                                      SHA512

                                                      555b04fcb4fb1b49f35bd99bbcc9e40b85bec6fb604c71ce997a0027eb616248e0cd225de905c2d72b5e72763383438250a0063fefdf3323137e075b76cc63c5

                                                    • C:\Users\Admin\AppData\Local\Temp\1018062001\f5157e8889.exe

                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      ef08a45833a7d881c90ded1952f96cb4

                                                      SHA1

                                                      f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                                                      SHA256

                                                      33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                                                      SHA512

                                                      74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                                                    • C:\Users\Admin\AppData\Local\Temp\1018063001\9a1777e7b3.exe

                                                      Filesize

                                                      791KB

                                                      MD5

                                                      e8af4d0d0b47ac68d762b7f288ae8e6e

                                                      SHA1

                                                      1d65f31526cc20ab41d6b1625d6674d7f13e326c

                                                      SHA256

                                                      b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

                                                      SHA512

                                                      80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

                                                    • C:\Users\Admin\AppData\Local\Temp\1018064001\477c0509ba.exe

                                                      Filesize

                                                      1.3MB

                                                      MD5

                                                      669ed3665495a4a52029ff680ec8eba9

                                                      SHA1

                                                      7785e285365a141e307931ca4c4ef00b7ecc8986

                                                      SHA256

                                                      2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                                                      SHA512

                                                      bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                                                    • C:\Users\Admin\AppData\Local\Temp\1018065001\69c3a4d93a.exe

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      04f57c6fb2b2cd8dcc4b38e4a93d4366

                                                      SHA1

                                                      61770495aa18d480f70b654d1f57998e5bd8c885

                                                      SHA256

                                                      51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                                                      SHA512

                                                      53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                                                    • C:\Users\Admin\AppData\Local\Temp\1018066001\4e6c5211b6.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      bdf0a999471704099de200c1b8d4f5a5

                                                      SHA1

                                                      887df22c17b497db45aabd65c03c99baea6091f9

                                                      SHA256

                                                      43edbdfbc0965167d308cd328673c0be4e6e93d5144336f65eba2006161e6bc8

                                                      SHA512

                                                      f6850301552cc95891caf0899237af6353b8c492c9cb2c4aae2f37ef18b19445b6a6e2a12d270d7c43d889c5686b29be121945e112da579dc72bfd1fd6d06475

                                                    • C:\Users\Admin\AppData\Local\Temp\1018067001\81bc274c20.exe

                                                      Filesize

                                                      2.7MB

                                                      MD5

                                                      17689ee1bc4b479f392aa69876e90e3e

                                                      SHA1

                                                      1f3870d8224ff1105b03753f6850f8d66ba077ff

                                                      SHA256

                                                      0bb4fdf5ddb431f5d0716e4d9094fa3bbbee5fe2ba97b98cbe25c4593f15c5e7

                                                      SHA512

                                                      a681565417c865be4aa4b506726efcd161fc6d3c90d98797d05869f5eec5108f94782e6c6cb774b4b719e541110b9f1b6164e80deaed6a7235faea64ee8fa450

                                                    • C:\Users\Admin\AppData\Local\Temp\1018068001\b24d56b4d9.exe

                                                      Filesize

                                                      945KB

                                                      MD5

                                                      94ae8249f4bf0e363bbcc67b69d52bd0

                                                      SHA1

                                                      b917ee5b27c344c0147609bb994294acf9d8d6f9

                                                      SHA256

                                                      9e5456a9bf5f36dd3b8288997b16fe3c55b0800b938328b481e637b4e0371e34

                                                      SHA512

                                                      34c76e44717763578cc62b884ead678226d0da7a0e6711d8b073197e6ee870bf293c9396e096d9c33de8f864dea81fcdc957a69e58e7b771ff262c36068abcb1

                                                    • C:\Users\Admin\AppData\Local\Temp\1018069001\0200dc27b8.exe

                                                      Filesize

                                                      2.7MB

                                                      MD5

                                                      f0e4922229913a534bd558065e1dafa2

                                                      SHA1

                                                      c8d9257cd350a3b19450b584640af08a8a9a5841

                                                      SHA256

                                                      73ca2fe54c0712c8ccb343ee59fdc4bfa257d57e865ba35999bcf8d099b5a588

                                                      SHA512

                                                      80147ac5e71696ec84419e2fbfdceac6e9c6bd8906600b49a9c1baa159b006ce7c92aa8eceeeacd414aeba7408b8d640421b27cd588ba1aa24b366384493fc57

                                                    • C:\Users\Admin\AppData\Local\Temp\1018070001\35cca5c170.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      83aa26bd8755e994141c4b6d525307ba

                                                      SHA1

                                                      1cc2485520840247010cd5a2a6f6ba69924a8da5

                                                      SHA256

                                                      0e5c004b6ac8fd180951d14352e8eb0e4b9b3d4e32dbeaa194a7af7c77d3b4d7

                                                      SHA512

                                                      ad96208839e796d6572385c838141d2b96c55388afa21d3eeca8a11135f51fd49c5f80a5de9aa1c0925cb3fea9c626bb9a42e16556eaabc2baaf727c58cf3fdb

                                                    • C:\Users\Admin\AppData\Local\Temp\1018071001\9a9afce362.exe

                                                      Filesize

                                                      4.2MB

                                                      MD5

                                                      3a425626cbd40345f5b8dddd6b2b9efa

                                                      SHA1

                                                      7b50e108e293e54c15dce816552356f424eea97a

                                                      SHA256

                                                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                                      SHA512

                                                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                                    • C:\Users\Admin\AppData\Local\Temp\1018072001\616e3ded96.exe

                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      ff279f4e5b1c6fbda804d2437c2dbdc8

                                                      SHA1

                                                      2feb3762c877a5ae3ca60eeebc37003ad0844245

                                                      SHA256

                                                      e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                                                      SHA512

                                                      c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                                                    • C:\Users\Admin\AppData\Local\Temp\1018073001\6f1d33df34.exe

                                                      Filesize

                                                      1.9MB

                                                      MD5

                                                      e5129dcbd20769ce04b87c5ea32bf280

                                                      SHA1

                                                      4380cf7eaae822456b3b850661c219f5cdb32169

                                                      SHA256

                                                      da40b7cf993a8f9173ee4fdb1830c9cc780c8ac372a0f1961392817360a53186

                                                      SHA512

                                                      8ffed94739ef07725377b6c6f5d48f875d8bd0a4253bb7fe5163d7824848d033234ae7b1104ca9dea9a1187b9d20ec5674d6772546fe1d3a4068c63b575428b0

                                                    • C:\Users\Admin\AppData\Local\Temp\1018074001\4c2179552a.exe

                                                      Filesize

                                                      21KB

                                                      MD5

                                                      14becdf1e2402e9aa6c2be0e6167041e

                                                      SHA1

                                                      72cbbae6878f5e06060a0038b25ede93b445f0df

                                                      SHA256

                                                      7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                                                      SHA512

                                                      16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                                                    • C:\Users\Admin\AppData\Local\Temp\1018075001\97d47a2440.exe

                                                      Filesize

                                                      3.1MB

                                                      MD5

                                                      c00a67d527ef38dc6f49d0ad7f13b393

                                                      SHA1

                                                      7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                                                      SHA256

                                                      12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                                                      SHA512

                                                      9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                                                    • C:\Users\Admin\AppData\Local\Temp\Cab7DBA.tmp

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                                      SHA1

                                                      1723be06719828dda65ad804298d0431f6aff976

                                                      SHA256

                                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                      SHA512

                                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                    • C:\Users\Admin\AppData\Local\Temp\Tar7DFB.tmp

                                                      Filesize

                                                      181KB

                                                      MD5

                                                      4ea6026cf93ec6338144661bf1202cd1

                                                      SHA1

                                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                                      SHA256

                                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                      SHA512

                                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      744e8a3718a8bccb6c0bfe243c7ac195

                                                      SHA1

                                                      06ad06e208965913a03307439e68f1168027fb89

                                                      SHA256

                                                      9c41a2f71bf50c12c268e61147794c07e5a65642cd2a08235f5dce0ad0cdbc63

                                                      SHA512

                                                      66802302b003b51072a4eba3b81dd4728f88d642a5813d57e402fd4ab23b4f0f6f07f6812380b6c5bc42818c6a6efc32654405c96253befd023c1b26d5286273

                                                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

                                                      Filesize

                                                      458KB

                                                      MD5

                                                      619f7135621b50fd1900ff24aade1524

                                                      SHA1

                                                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                      SHA256

                                                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                      SHA512

                                                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat

                                                      Filesize

                                                      440B

                                                      MD5

                                                      3626532127e3066df98e34c3d56a1869

                                                      SHA1

                                                      5fa7102f02615afde4efd4ed091744e842c63f78

                                                      SHA256

                                                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                                      SHA512

                                                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                      Filesize

                                                      442KB

                                                      MD5

                                                      85430baed3398695717b0263807cf97c

                                                      SHA1

                                                      fffbee923cea216f50fce5d54219a188a5100f41

                                                      SHA256

                                                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                      SHA512

                                                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                      Filesize

                                                      8.0MB

                                                      MD5

                                                      a01c5ecd6108350ae23d2cddf0e77c17

                                                      SHA1

                                                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                      SHA256

                                                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                      SHA512

                                                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CAUPEQT6MDBQZZ7ZSLLM.temp

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      3fa5db268cebdcfad35938e5fd07c069

                                                      SHA1

                                                      50f7f9e7eaa5306ad94a5565e9b457735de9b07c

                                                      SHA256

                                                      7c54330536af2d38ff8aef7c67d1da98ab8427e6299494f05b0fad9f663529b3

                                                      SHA512

                                                      c7b9b070b2b76ea2d607f93cc6ec980cd279dcc834117eaf159bbe953ccd5b8c5589f0f291f2ad2948b0d8d3914492a366c6c88f3eb10dbec5ef790f3d0a9dfa

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      e7e6e169e7faef2fbf622f3f5a7e4338

                                                      SHA1

                                                      497a0191f3e8fb90733e0dd05953688bb1e3a942

                                                      SHA256

                                                      62e5172d73434e321fc22908667fa7d00c9a69f6a4b1e9100ad57aa41fdc4659

                                                      SHA512

                                                      44d1163a3f4147dc84bdfa583f61bfef1818dd57e7772db102bd6b425ca5abe0b718e157d6fa8a4ed3ae5589aac44dfc1dca7e4b3010cacc47216c36fe105467

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

                                                      Filesize

                                                      9KB

                                                      MD5

                                                      07b084134f6379ef8404dd6f4cadcb30

                                                      SHA1

                                                      89ebf34cb43f780140de77d21b0ac6f0f58a7277

                                                      SHA256

                                                      aab87baaababfe70a386b6fe4c1363fb5d72cf1cbbc8fd5d163ad84b05d38a65

                                                      SHA512

                                                      3c0621051a25460fdf54f619b80d5ef51f0a1054a78880d2ed8841b624c43aaa37717d32bce4d9d6e6d63b5a123fc804c2ed0c27f547e3f36e966ff2af9e7173

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\b3d8b3de-345e-4ea9-83a4-6161224d386d

                                                      Filesize

                                                      733B

                                                      MD5

                                                      a915281a2233ed8ad9089cb40021a162

                                                      SHA1

                                                      56a8b3b1559b6894926584ad74e94507370c2aac

                                                      SHA256

                                                      a45826a03423bd2ac4c59f72187d111a29fad63ed776884e3f6fbd31b99201ac

                                                      SHA512

                                                      ce6185deaa118b1ffc813d1ebf3ab2e8e07c86f0f920a7b793ddccad00fe752b2bc408f5ecdc504006b52ccea2f23e80a703b6dc0c7b64d37f5714294e64f13f

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                      Filesize

                                                      997KB

                                                      MD5

                                                      fe3355639648c417e8307c6d051e3e37

                                                      SHA1

                                                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                      SHA256

                                                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                      SHA512

                                                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                      Filesize

                                                      116B

                                                      MD5

                                                      3d33cdc0b3d281e67dd52e14435dd04f

                                                      SHA1

                                                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                      SHA256

                                                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                      SHA512

                                                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                      Filesize

                                                      479B

                                                      MD5

                                                      49ddb419d96dceb9069018535fb2e2fc

                                                      SHA1

                                                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                      SHA256

                                                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                      SHA512

                                                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                      Filesize

                                                      372B

                                                      MD5

                                                      8be33af717bb1b67fbd61c3f4b807e9e

                                                      SHA1

                                                      7cf17656d174d951957ff36810e874a134dd49e0

                                                      SHA256

                                                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                      SHA512

                                                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                      Filesize

                                                      11.8MB

                                                      MD5

                                                      33bf7b0439480effb9fb212efce87b13

                                                      SHA1

                                                      cee50f2745edc6dc291887b6075ca64d716f495a

                                                      SHA256

                                                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                      SHA512

                                                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      688bed3676d2104e7f17ae1cd2c59404

                                                      SHA1

                                                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                      SHA256

                                                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                      SHA512

                                                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      937326fead5fd401f6cca9118bd9ade9

                                                      SHA1

                                                      4526a57d4ae14ed29b37632c72aef3c408189d91

                                                      SHA256

                                                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                      SHA512

                                                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      27061fdd9942931782cdb021e74fd21c

                                                      SHA1

                                                      d9f4cb4a09c2302ec3c7e54ef31348d36697041c

                                                      SHA256

                                                      e898bbc36cafecdadfebd360b40671786bae0b48bba7836c36855a2bc72a6b93

                                                      SHA512

                                                      6ad1e88dd2b9ebe856a753f23409971d634199a1f2c4c7ab12bb1447b520e62f7f252242f0017b8031707a9d1ed774805e78b5156219f0f96182a3e76c656056

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      357c887e26ac09c3b9e36b69c707c301

                                                      SHA1

                                                      65e4930d3520f87361f375079e74f92877709d26

                                                      SHA256

                                                      b0c91c0160edb4fd029cf655b638390cbae8b1498cb3bffc9c0d0b7e8585fe5f

                                                      SHA512

                                                      6d457168c9f9e92c1e06924aa4e16fad9e1c703b9cc7621d419d82d1a33e23b8f0e227ec4afa86d888bdf3befb70d42199e893641d3747052f1e69ec6045ffc2

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      f125b0d8134ce6689516d61403de7605

                                                      SHA1

                                                      a673b9459abe38fd5d3c6d4d6272712080a41e39

                                                      SHA256

                                                      f32fdc3cf9388495134e97b579a84ff17a0bbde2639ff045f1de665a2490d747

                                                      SHA512

                                                      e8edff4a64b4f1082ed03e8111276df8347ba291b841bf7f239a85ebd40c3d539ef8e6470372b9da532621a75db92239db59f3823114bbc451f2924a542d39c3

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      64386662cf1ff0a364bfdb9182126e4e

                                                      SHA1

                                                      79d953d1b517422f7e82d3fa0ddf347ca664f635

                                                      SHA256

                                                      413f5f03700d5098ccbd4b78a0c525bb0b047e90867c1823495901210c0448cc

                                                      SHA512

                                                      cd518b70b1b75db3fd049d4a4d9a9055346bbcdff82646cd7a11437a27dabf10b855e0b23b7aafc621067612047065c934227d554bd34c8160539afb64b351ef

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      7f41c614b1bd81760db474267036fbd1

                                                      SHA1

                                                      04b15d45e04d712f2f1bf1ac010d0b88b805adfb

                                                      SHA256

                                                      e2ae03b691d4fb7410a31d4813867dc4ace5a8b50038f900171b5451992d42b2

                                                      SHA512

                                                      682105861b09ac899edcac5c08b0e4362d20cbac8497c0040247fa92192b961153a06222b87229322929dcb7e7f250dec7adf844427d4fc75d686127c5975fca

                                                    • memory/272-306-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-310-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-320-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-322-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-324-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-326-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-2388-0x0000000000580000-0x00000000005AC000-memory.dmp

                                                      Filesize

                                                      176KB

                                                    • memory/272-2389-0x0000000000670000-0x00000000006BC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/272-328-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-330-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-309-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-318-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-332-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-299-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-312-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-314-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-316-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-334-0x00000000021D0000-0x0000000002261000-memory.dmp

                                                      Filesize

                                                      580KB

                                                    • memory/272-308-0x00000000021D0000-0x0000000002268000-memory.dmp

                                                      Filesize

                                                      608KB

                                                    • memory/272-295-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-307-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-297-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-304-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/272-303-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/272-301-0x0000000000400000-0x0000000000464000-memory.dmp

                                                      Filesize

                                                      400KB

                                                    • memory/1012-214-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-202-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-207-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-212-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-211-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1012-209-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-203-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1012-205-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/1104-291-0x0000000000230000-0x00000000006DE000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1268-158-0x00000000013A0000-0x000000000184B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1268-132-0x00000000013A0000-0x000000000184B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/1596-154-0x0000000000360000-0x0000000000FF9000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/1596-159-0x0000000000360000-0x0000000000FF9000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/1776-231-0x00000000013B0000-0x0000000001507000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/1972-2780-0x00000000010C0000-0x0000000001374000-memory.dmp

                                                      Filesize

                                                      2.7MB

                                                    • memory/1972-2779-0x00000000010C0000-0x0000000001374000-memory.dmp

                                                      Filesize

                                                      2.7MB

                                                    • memory/2192-246-0x0000000000E00000-0x0000000000E0C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2256-136-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2256-101-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2256-229-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2256-274-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2256-160-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2256-3150-0x0000000001230000-0x0000000001D8C000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2500-3246-0x0000000002690000-0x0000000002698000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2500-3245-0x000000001B6B0000-0x000000001B992000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                    • memory/2600-43-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-99-0x0000000006570000-0x000000000686A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2600-161-0x0000000006B90000-0x000000000703B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-18-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-155-0x0000000006B90000-0x0000000007829000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/2600-17-0x0000000000931000-0x000000000095F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/2600-153-0x0000000006B90000-0x0000000007829000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/2600-20-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-190-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-215-0x0000000006B90000-0x0000000007829000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/2600-135-0x0000000006B90000-0x00000000076EC000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2600-134-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-129-0x0000000006B90000-0x000000000703B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-130-0x0000000006B90000-0x000000000703B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-2404-0x0000000006B90000-0x000000000703E000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-230-0x0000000006B90000-0x0000000007829000-memory.dmp

                                                      Filesize

                                                      12.6MB

                                                    • memory/2600-270-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-162-0x0000000006B90000-0x000000000703B000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-271-0x0000000006B90000-0x000000000703E000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/2600-40-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-100-0x0000000006B90000-0x00000000076EC000-memory.dmp

                                                      Filesize

                                                      11.4MB

                                                    • memory/2600-76-0x0000000006570000-0x000000000686A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2600-60-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-16-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-36-0x0000000000930000-0x0000000000C4E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2600-38-0x0000000006570000-0x000000000686A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2600-37-0x0000000006570000-0x000000000686A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2624-273-0x0000000004A20000-0x0000000004AE2000-memory.dmp

                                                      Filesize

                                                      776KB

                                                    • memory/2624-181-0x0000000000760000-0x0000000000786000-memory.dmp

                                                      Filesize

                                                      152KB

                                                    • memory/2624-180-0x0000000000070000-0x0000000000186000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2668-2-0x0000000000FF1000-0x000000000101F000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/2668-3-0x0000000000FF0000-0x000000000130E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2668-5-0x0000000000FF0000-0x000000000130E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2668-1-0x00000000777D0000-0x00000000777D2000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/2668-0-0x0000000000FF0000-0x000000000130E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2668-15-0x0000000000FF0000-0x000000000130E000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/2672-113-0x0000000001340000-0x000000000163A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2672-41-0x0000000001340000-0x000000000163A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/2672-102-0x0000000001340000-0x000000000163A000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/6628-3009-0x0000000001E70000-0x0000000001E78000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/6628-3008-0x000000001B750000-0x000000001BA32000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                    • memory/8256-3098-0x0000000000B00000-0x0000000000B0C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/9208-3136-0x00000000003A0000-0x00000000006C8000-memory.dmp

                                                      Filesize

                                                      3.2MB

                                                    • memory/9208-3257-0x0000000005810000-0x0000000005966000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/9208-3258-0x00000000006E0000-0x0000000000702000-memory.dmp

                                                      Filesize

                                                      136KB