Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    2.9MB

  • MD5

    9765ac8d5874ba1323875aa901871db6

  • SHA1

    376dcb324421e41140e2ff169c2e3f2c39625fe1

  • SHA256

    d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099

  • SHA512

    e3b56ccdb50d10de0bedf9067d2d19e16c01feb0116bfa429f9c027dd1c58261f104fceb64ea1bccb04b3f6cde2089431e6f7a2bf863bae6d7eb0163e761aac3

  • SSDEEP

    49152:Bmk5SFVjS0dcpj+RbpQ2nWy8uu5PJY+e8iVVsaz:BVSzjS0Spj+Fy2nB8V5PC+9YVsa

Score
10/10
amadeygcleanerlummavidarxmrig9c9aa5credential_accessdiscoveryevasionexecutionloaderminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 3 IoCs
    stealer
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • XMRig Miner payload 10 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 44 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 54 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Users\Admin\AppData\Local\Temp\1018583001\445a30578f.exe
        "C:\Users\Admin\AppData\Local\Temp\1018583001\445a30578f.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:2596
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p24291711423417250691697322505 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2728
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_7.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4540
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4516
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4828
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2208
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4564
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4456
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3368
            • C:\Windows\system32\attrib.exe
              attrib +H "in.exe"
              5⤵
              • Views/modifies file attributes
              PID:3372
            • C:\Users\Admin\AppData\Local\Temp\main\in.exe
              "in.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4768
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:3900
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                6⤵
                • Views/modifies file attributes
                PID:2800
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4804
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.0.0.1; del in.exe
                6⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:400
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.0.0.1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:264
        • C:\Users\Admin\AppData\Local\Temp\1018585001\d365ae36cf.exe
          "C:\Users\Admin\AppData\Local\Temp\1018585001\d365ae36cf.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4792
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\vmpqsiis"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3484
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:220
          • C:\vmpqsiis\e0fcd0b83d9544c69076ef29ebbbc415.exe
            "C:\vmpqsiis\e0fcd0b83d9544c69076ef29ebbbc415.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1876
        • C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe
          "C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:556
        • C:\Users\Admin\AppData\Local\Temp\1018587001\1ac17ce294.exe
          "C:\Users\Admin\AppData\Local\Temp\1018587001\1ac17ce294.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1520
          • C:\Users\Admin\AppData\Local\Temp\1018587001\1ac17ce294.exe
            "C:\Users\Admin\AppData\Local\Temp\1018587001\1ac17ce294.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4896
        • C:\Users\Admin\AppData\Local\Temp\1018588001\26b9e0cccf.exe
          "C:\Users\Admin\AppData\Local\Temp\1018588001\26b9e0cccf.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1728
        • C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe
          "C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:1824
          • C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe
            "C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe"
            4⤵
            • Executes dropped EXE
            PID:4732
          • C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe
            "C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3844
        • C:\Users\Admin\AppData\Local\Temp\1018590001\7e72273cde.exe
          "C:\Users\Admin\AppData\Local\Temp\1018590001\7e72273cde.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4804
        • C:\Users\Admin\AppData\Local\Temp\1018591001\8e8aab79c6.exe
          "C:\Users\Admin\AppData\Local\Temp\1018591001\8e8aab79c6.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2736
        • C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe
          "C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2652
          • C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe
            "C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe"
            4⤵
            • Executes dropped EXE
            PID:3496
          • C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe
            "C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe"
            4⤵
            • Executes dropped EXE
            PID:4064
          • C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe
            "C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3572
        • C:\Users\Admin\AppData\Local\Temp\1018593001\6100e0f086.exe
          "C:\Users\Admin\AppData\Local\Temp\1018593001\6100e0f086.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2600
        • C:\Users\Admin\AppData\Local\Temp\1018594001\52827e2f8a.exe
          "C:\Users\Admin\AppData\Local\Temp\1018594001\52827e2f8a.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:412
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\zmlrex"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3900
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4284
          • C:\zmlrex\b3082ead54864e6baf8791ac47ef47bb.exe
            "C:\zmlrex\b3082ead54864e6baf8791ac47ef47bb.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1512
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\zmlrex\b3082ead54864e6baf8791ac47ef47bb.exe" & rd /s /q "C:\ProgramData\NGDBS2NOP8YM" & exit
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1848
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 10
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1116
          • C:\zmlrex\22ab9842b6a4427893bf613fb528ada9.exe
            "C:\zmlrex\22ab9842b6a4427893bf613fb528ada9.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4652
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
              5⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4460
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdab246f8,0x7ffbdab24708,0x7ffbdab24718
                6⤵
                  PID:3384
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                  6⤵
                    PID:3748
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
                    6⤵
                      PID:5060
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                      6⤵
                        PID:3608
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                        6⤵
                          PID:2028
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
                          6⤵
                            PID:212
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1232
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                            6⤵
                              PID:4796
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
                              6⤵
                                PID:2236
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
                                6⤵
                                  PID:5496
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8243443085612823223,10377820382861893729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                  6⤵
                                    PID:5508
                            • C:\Users\Admin\AppData\Local\Temp\1018595001\d073916cb2.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018595001\d073916cb2.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:640
                              • C:\Users\Admin\AppData\Local\Temp\1018595001\d073916cb2.exe
                                "C:\Users\Admin\AppData\Local\Temp\1018595001\d073916cb2.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5160
                            • C:\Users\Admin\AppData\Local\Temp\1018596001\a03a07069a.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018596001\a03a07069a.exe"
                              3⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2784
                            • C:\Users\Admin\AppData\Local\Temp\1018597001\f338ce48f7.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018597001\f338ce48f7.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4312
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1160
                                4⤵
                                • Program crash
                                PID:2596
                            • C:\Users\Admin\AppData\Local\Temp\1018598001\c59e7ff124.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018598001\c59e7ff124.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:5172
                            • C:\Users\Admin\AppData\Local\Temp\1018599001\274a85bb78.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018599001\274a85bb78.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              PID:8060
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                4⤵
                                • Uses browser remote debugging
                                • Enumerates system info in registry
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:7080
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe1cecc40,0x7ffbe1cecc4c,0x7ffbe1cecc58
                                  5⤵
                                    PID:4972
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1988 /prefetch:2
                                    5⤵
                                      PID:7088
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1880,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:3
                                      5⤵
                                        PID:6296
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2248 /prefetch:8
                                        5⤵
                                          PID:6232
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                                          5⤵
                                          • Uses browser remote debugging
                                          PID:6396
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3332 /prefetch:1
                                          5⤵
                                          • Uses browser remote debugging
                                          PID:5232
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,7480957738761339596,11555820612816675783,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4292 /prefetch:1
                                          5⤵
                                          • Uses browser remote debugging
                                          PID:7004
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                        4⤵
                                        • Uses browser remote debugging
                                        • Enumerates system info in registry
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        PID:4488
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbde0346f8,0x7ffbde034708,0x7ffbde034718
                                          5⤵
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:3748
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                                          5⤵
                                            PID:4396
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
                                            5⤵
                                              PID:5516
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
                                              5⤵
                                                PID:5964
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:6400
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:7072
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:7428
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                                5⤵
                                                • Uses browser remote debugging
                                                PID:7540
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                5⤵
                                                  PID:5312
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                                                  5⤵
                                                    PID:5336
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15827971107375686448,1427899852348677196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2632 /prefetch:2
                                                    5⤵
                                                      PID:7268
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\BFIIEHJDBK.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:7632
                                                    • C:\Users\Admin\Documents\BFIIEHJDBK.exe
                                                      "C:\Users\Admin\Documents\BFIIEHJDBK.exe"
                                                      5⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      PID:7420
                                                • C:\Users\Admin\AppData\Local\Temp\1018600001\005db8ef2b.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1018600001\005db8ef2b.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:3560
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM firefox.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5872
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM chrome.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5316
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM msedge.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:6888
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM opera.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:6684
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /IM brave.exe /T
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:6508
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                    4⤵
                                                      PID:5848
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                        5⤵
                                                        • Checks processor information in registry
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:6288
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b1dcd03-42f8-44d9-b202-18282603f184} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" gpu
                                                          6⤵
                                                            PID:7736
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {128616e1-311e-4384-acf3-f592ba76ea8f} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" socket
                                                            6⤵
                                                              PID:7908
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -childID 1 -isForBrowser -prefsHandle 2816 -prefMapHandle 3308 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54e3d100-c097-4c78-9d73-693f8983b0fd} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" tab
                                                              6⤵
                                                                PID:840
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4192 -childID 2 -isForBrowser -prefsHandle 4184 -prefMapHandle 4180 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {558df29d-02f8-4b93-bff7-44801449e2a5} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" tab
                                                                6⤵
                                                                  PID:6620
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4760 -prefMapHandle 4784 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff1e21ae-4579-4276-a977-18ccd3789891} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" utility
                                                                  6⤵
                                                                  • Checks processor information in registry
                                                                  PID:6316
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5140 -childID 3 -isForBrowser -prefsHandle 5172 -prefMapHandle 5188 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e66059-c431-4331-8e8b-4452c2ff26dd} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" tab
                                                                  6⤵
                                                                    PID:7064
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 4 -isForBrowser -prefsHandle 5240 -prefMapHandle 5172 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc74949e-a98d-4fa0-b7af-b0e486e8d088} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" tab
                                                                    6⤵
                                                                      PID:6928
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 5 -isForBrowser -prefsHandle 5536 -prefMapHandle 5540 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5793c4b-a4ff-4f75-b772-639aa5844433} 6288 "\\.\pipe\gecko-crash-server-pipe.6288" tab
                                                                      6⤵
                                                                        PID:6900
                                                                • C:\Users\Admin\AppData\Local\Temp\1018601001\8ab40ab135.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1018601001\8ab40ab135.exe"
                                                                  3⤵
                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Windows security modification
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:7392
                                                                • C:\Users\Admin\AppData\Local\Temp\1018602001\5bdc8c17f9.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1018602001\5bdc8c17f9.exe"
                                                                  3⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Identifies Wine through registry keys
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4792
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1484
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:7152
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1440
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:6716
                                                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                              1⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4284
                                                            • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                              C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1288
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4528
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                                2⤵
                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4732
                                                                • C:\Windows\system32\PING.EXE
                                                                  "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                                  3⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:4488
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:4896
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:1580
                                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                  1⤵
                                                                    PID:4156
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4792 -ip 4792
                                                                    1⤵
                                                                      PID:5536
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 4792
                                                                      1⤵
                                                                        PID:5552
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4312 -ip 4312
                                                                        1⤵
                                                                          PID:3312
                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          PID:5408
                                                                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:4544
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            2⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5232
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                                                                            2⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6476
                                                                            • C:\Windows\system32\PING.EXE
                                                                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                                                                              3⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:4704

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Command and Scripting Interpreter

                                                                        1
                                                                        T1059

                                                                        PowerShell

                                                                        1
                                                                        T1059.001

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        1
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Modify Authentication Process

                                                                        1
                                                                        T1556

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        1
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Defense Evasion

                                                                        Hide Artifacts

                                                                        1
                                                                        T1564

                                                                        Hidden Files and Directories

                                                                        1
                                                                        T1564.001

                                                                        Impair Defenses

                                                                        2
                                                                        T1562

                                                                        Disable or Modify Tools

                                                                        2
                                                                        T1562.001

                                                                        Modify Authentication Process

                                                                        1
                                                                        T1556

                                                                        Modify Registry

                                                                        3
                                                                        T1112

                                                                        Virtualization/Sandbox Evasion

                                                                        3
                                                                        T1497

                                                                        Credential Access

                                                                        Credentials from Password Stores

                                                                        1
                                                                        T1555

                                                                        Credentials from Web Browsers

                                                                        1
                                                                        T1555.003

                                                                        Modify Authentication Process

                                                                        1
                                                                        T1556

                                                                        Steal Web Session Cookie

                                                                        1
                                                                        T1539

                                                                        Unsecured Credentials

                                                                        4
                                                                        T1552

                                                                        Credentials In Files

                                                                        4
                                                                        T1552.001

                                                                        Discovery

                                                                        Browser Information Discovery

                                                                        1
                                                                        T1217

                                                                        Query Registry

                                                                        9
                                                                        T1012

                                                                        Remote System Discovery

                                                                        1
                                                                        T1018

                                                                        System Information Discovery

                                                                        5
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        System Network Configuration Discovery

                                                                        1
                                                                        T1016

                                                                        Internet Connection Discovery

                                                                        1
                                                                        T1016.001

                                                                        Virtualization/Sandbox Evasion

                                                                        3
                                                                        T1497

                                                                        Lateral Movement

                                                                        Collection

                                                                        Data from Local System

                                                                        3
                                                                        T1005

                                                                        Command and Control

                                                                        Web Service

                                                                        1
                                                                        T1102

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\ProgramData\mozglue.dll
                                                                          Filesize

                                                                          593KB

                                                                          MD5

                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                          SHA1

                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                          SHA256

                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                          SHA512

                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          d751713988987e9331980363e24189ce

                                                                          SHA1

                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                          SHA256

                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                          SHA512

                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                          SHA1

                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                          SHA256

                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                          SHA512

                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          968cb9309758126772781b83adb8a28f

                                                                          SHA1

                                                                          8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                          SHA256

                                                                          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                          SHA512

                                                                          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                          Filesize

                                                                          418B

                                                                          MD5

                                                                          ce67356e50097678a13049f4d9523e66

                                                                          SHA1

                                                                          3d43e69dbbfc08af6942e16ed0a5ea9b9d91a412

                                                                          SHA256

                                                                          466291109fc18078ada2d40aefaeb35fbc4a9f2eab19c14a97ebed5cf2f1be78

                                                                          SHA512

                                                                          8ebaa90edd0870c65dd508f8bea05ac55f3c9effb228c6391608eefba635beda29d9a79db3a928575830d5788f4a3e745d2078f0b5b31b4ed801275377cdc081

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\508083f9-c3b7-4168-bf6f-d36caadf820f.dmp
                                                                          Filesize

                                                                          826KB

                                                                          MD5

                                                                          71bb17770dae8b3e4739791f03c67f7d

                                                                          SHA1

                                                                          f7f92a64c2e89a38caeae4ab12670a3147a71c7f

                                                                          SHA256

                                                                          eae01664eca83ae2f62802093a11ddb7d890291782af63c62fc4dedd3dcb04b0

                                                                          SHA512

                                                                          0715e1814572a067613482e529833910bcff8f79bd2cc95b5cda4d11469eed146c14d1f1ae3df1d15d0d5af1b2478c40e632facf0f89968d682de0c76870cf00

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b438a793-3986-4498-a783-b04111af572b.dmp
                                                                          Filesize

                                                                          830KB

                                                                          MD5

                                                                          3878e5ce40dff581c9933e4a52afaf4d

                                                                          SHA1

                                                                          f469b91a59120d5466dadf8b537b059f36d63522

                                                                          SHA256

                                                                          c2576c30304f17f6a56e73ed1d7862bb210cb2565155093aac9c3825997e372d

                                                                          SHA512

                                                                          29a3355eed3c12ad39b52b58ca56626d074fef10d40945b9bea9e67b0e83d3076ec31234661854181986fd90f98e7807bd457877842bd20baa49cc68b10f001f

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ed94fb39-8ae0-4f1f-b3bd-0e2b3982e155.dmp
                                                                          Filesize

                                                                          826KB

                                                                          MD5

                                                                          6a84512df2b1f45e4c77bbaf83c2e5c8

                                                                          SHA1

                                                                          7f8de049e721fd26c4dbf066f8e7f83eea39448e

                                                                          SHA256

                                                                          dfc3258a853cf5f7e97c408f903ae54e7b05857c4a6049f4b54b06e63d485f01

                                                                          SHA512

                                                                          840eac1d9124f5f656465d116470565370f6456fc073f978d4cde51223d779558372e43b260c63156fe5c79c21e76985a77a44d5c99ff8664aa04153964f4bfc

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          74d75945aed1c6f3a3ecf9ef23a30acc

                                                                          SHA1

                                                                          7d49a615f48589f735b7dc003e83adabe7331fa2

                                                                          SHA256

                                                                          91ff472b5efa0b6dea52621534a58a90e7f6de9234c81658f939da89263c1da6

                                                                          SHA512

                                                                          98ec24fef768c385fdeb518beb0430510553de5d4e41dda8c7f737e44f9cb072caff867a2f6f4ac0b11303145e2de77e86891ef89ce40544e57c1d8f44b3aee3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          bcbbf4e2fef25fee65008a76505d3087

                                                                          SHA1

                                                                          812c0f76f881ece87084ba8089d2af7932a6c119

                                                                          SHA256

                                                                          5f89e2800bd39c0b0f7d5472c194c8498beb6021231b94cf26a4bb46ac6e9074

                                                                          SHA512

                                                                          f228845a5670f4802fb405a6e0897664027c19ed7d7abac247ab6eccd8d53a91a23d5effe035fc093e497b2aee61f76152025c74343725f7af30ffe9971c403b

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          00ce4fafa6a0afd3771904f333250835

                                                                          SHA1

                                                                          15c116f8fa0dd57e2f09e9bf3f92bfd124757fbd

                                                                          SHA256

                                                                          9449cf6b92d2b10cb5cdd4427217b792cf546d33e52f31404dd5d98d61d43ce4

                                                                          SHA512

                                                                          d9c2e17da6b4473a040cb8ed9211bcc60c4eed588d29c642d8c661a1f9b8df994729ec8221653c544ccc3ac91ec8d8ccc47f209244c294c230aa85643e5a452c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          8962792ab94478f10a6a7713dd53954f

                                                                          SHA1

                                                                          1dc72bacf31404fc339ec04c53a3f751422935c4

                                                                          SHA256

                                                                          0b25eea316354d7c8f292e11f5dd794c5660745be10a5cede4bab3c08182c283

                                                                          SHA512

                                                                          0907307c02db1fa616a2f1dba0816f688e198fb49ad9ed407e492df1e6ba880bc356c56c8000e4986ab12eb51851819c4d7448964e955bfcb483192ed0ddc4c4

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          37f660dd4b6ddf23bc37f5c823d1c33a

                                                                          SHA1

                                                                          1c35538aa307a3e09d15519df6ace99674ae428b

                                                                          SHA256

                                                                          4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                                                          SHA512

                                                                          807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          Filesize

                                                                          152B

                                                                          MD5

                                                                          d7cb450b1315c63b1d5d89d98ba22da5

                                                                          SHA1

                                                                          694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                                                          SHA256

                                                                          38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                                                          SHA512

                                                                          df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13c00647-bae4-425f-a201-3a46b1064951.tmp
                                                                          Filesize

                                                                          1B

                                                                          MD5

                                                                          5058f1af8388633f609cadb75a75dc9d

                                                                          SHA1

                                                                          3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                          SHA256

                                                                          cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                          SHA512

                                                                          0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          3ee1f64070f4d5c5580e719857bfa220

                                                                          SHA1

                                                                          265779759fe1e5e464decae528e172f6ad2dda13

                                                                          SHA256

                                                                          39e58f1499ffd6f046a26b299598192797441c69d384de1ee31ba7f4144baedd

                                                                          SHA512

                                                                          fdb886e863a918d7b966235b89da09cf2a3d129d315e69c93d7cd6fb35ea8994d854ec17d3a447c3571b2c9b58585da0b91c9e094d0ab539714b5f578b796ea0

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          44f5e26addda2d75455af66fd730d10a

                                                                          SHA1

                                                                          a6b4263cf4a7f46d7ed1a68e5d2d31c7770449fb

                                                                          SHA256

                                                                          f4bbf3d70a848b906391c0451d32c9a88e744a034e38c415e0b7019ba63b21f5

                                                                          SHA512

                                                                          30f9a372432426ab52f746657d7bd4f5fc9fa5726333d2e8eb7a4adc7fcf20c822cde9f26d620c3ce9e80e25df59b08494648e3aaab3c3a9f01ee9dab39e80d4

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          064c0fa626c957c04c6fa2f78debd41a

                                                                          SHA1

                                                                          c0d9b6964f6ecadcb7322ae8482c6cc2ea5df647

                                                                          SHA256

                                                                          f5c9d68de7452038300d0d36d74c11091cfa94802bc94b930ff560e558454d83

                                                                          SHA512

                                                                          402614b70bda3ff3f75dc43accfe19fb68d3823074b07f9f15531cc22b9ca6f2845bcf5b6ca9bf98574dd1953354e77e254464dff03e96b73a7f74fe37fcb5ed

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
                                                                          Filesize

                                                                          109B

                                                                          MD5

                                                                          53118f1e32f2a89c3319313ab913161b

                                                                          SHA1

                                                                          0d86c1a9a6aff788002ee9e4dba816bac4049d37

                                                                          SHA256

                                                                          944349048637d0d7bdc2c1340f249004c666c8166b92cda5b9b51d341de18870

                                                                          SHA512

                                                                          f72571de349864696ec6c15a7f211552160bd3dccbccff25b946fd261ede7ffd059eadf38cf5f4bf178da5a0b0f395ded2b78f0d7584b5669a8f975c4f42fcf7

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
                                                                          Filesize

                                                                          204B

                                                                          MD5

                                                                          d0f9cf937edd3f08626b265db4a1d89d

                                                                          SHA1

                                                                          61619c51895097443fff98e15436ffb7b01b2cb1

                                                                          SHA256

                                                                          519705e5aaa9f23d27ff57cd5ae7578109a4c14e49ea162c64eff86a884738e3

                                                                          SHA512

                                                                          8df2430cad46fbaa10ec382c8b940aa660aa1860f246739a266f93f85a220ebe259c1922970896beafae3952ea0b93fde7d7c1493e550a6df63a7bc5dca2f88a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                          Filesize

                                                                          16B

                                                                          MD5

                                                                          206702161f94c5cd39fadd03f4014d98

                                                                          SHA1

                                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                          SHA256

                                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                          SHA512

                                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                          Filesize

                                                                          16B

                                                                          MD5

                                                                          46295cac801e5d4857d09837238a6394

                                                                          SHA1

                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                          SHA256

                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                          SHA512

                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          551b418066cbc9bedfadb35535096ad5

                                                                          SHA1

                                                                          fc42c9d512d98e7ff8a15159e0795ab93114bcff

                                                                          SHA256

                                                                          969df105679e31fa379d93d44a4bf0736c57ac374126374c2719640cd191f646

                                                                          SHA512

                                                                          735c6b8de65aa3e8f41c0b6caa471067710b9e14f252e535f7ac930b78dc1d5eb5f9c621948ff682c8936ed80a1c2d7b632cf36aa70a204469423ea916b16f76

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                          Filesize

                                                                          264KB

                                                                          MD5

                                                                          f50f89a0a91564d0b8a211f8921aa7de

                                                                          SHA1

                                                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                          SHA256

                                                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                          SHA512

                                                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\download[1].htm
                                                                          Filesize

                                                                          1B

                                                                          MD5

                                                                          cfcd208495d565ef66e7dff9f98764da

                                                                          SHA1

                                                                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                          SHA256

                                                                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                          SHA512

                                                                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                          Filesize

                                                                          18KB

                                                                          MD5

                                                                          a181ad81137c29caf922a595c1281fa8

                                                                          SHA1

                                                                          dc3d7f49add43ed46ad45c31496d32378f2e00b0

                                                                          SHA256

                                                                          adefc2809e1cbab9bd633e40eae8ec3dbbef9f4b7d358414f0321f4d47331a59

                                                                          SHA512

                                                                          66c1a9b031cad5a802eaa5ba04539c70f36188c5159ece69a52ea805f12d2cb49c2d5efe00ae19ae7958e7b99955cce26cdc8a96cfb62bf35c50416ba39ce07c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                          Filesize

                                                                          18KB

                                                                          MD5

                                                                          4a453d3957757d99881b9ad8772584f3

                                                                          SHA1

                                                                          dd76475506576ef650c086fbe263b0050accce90

                                                                          SHA256

                                                                          dd7314d000258a1fcdb3e899fffb6042997a5ccf6f1471d822804ad0cdcb1d14

                                                                          SHA512

                                                                          7da93ef7d7853b83ca448988f19212f3c6af8d9b992cb82eb84adf7f102b787319c933b5c9fe7cbac8d75142278893317e29e7ffc20217e823b26a4688e8ba0d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json
                                                                          Filesize

                                                                          18KB

                                                                          MD5

                                                                          f767e3f2ae13eb69b43d0b8097b9545e

                                                                          SHA1

                                                                          f1c5864f5c2ff2c1392442691a3da248ae63cc2f

                                                                          SHA256

                                                                          fd199ef36513c068380a356b284bbcb7d401efb385d18a1230ab3d884f4e16fa

                                                                          SHA512

                                                                          b5279193dc95718c1f566a74a98452a911b520b751b5f1d99a734dfa9047f432a47b87859c1c2f5c3a2b639814aa262f6f78faec1690555f2e807056d0703e63

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31
                                                                          Filesize

                                                                          13KB

                                                                          MD5

                                                                          8744a4b0f6d5c07d15a7cf54957cc715

                                                                          SHA1

                                                                          c996e9312334966273fe0d521fff8fb2fc24738f

                                                                          SHA256

                                                                          106966d118111460ef1cd3feff29fa73e1cbe8cbf7658d0514862bdf0a67bb2b

                                                                          SHA512

                                                                          9046b2ee5a626166788b3563f68fe0a58924da9be1fc64190cbb31d2f4599ed377f8ecfebe22970857db10357e36ffadeccceba8805b5611d1aa06e5da34d6ef

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                                                          Filesize

                                                                          13KB

                                                                          MD5

                                                                          c188d0617585f6a5a3a5dda5594770b4

                                                                          SHA1

                                                                          e51a54916b58d052e01a1ec4ccdb496b6bdb8bc2

                                                                          SHA256

                                                                          f388b8f17242d38de173c13d2b89ce9e9d74e43653fa7174385d32a0471addf6

                                                                          SHA512

                                                                          4f304a89ae0abb765c129c592e9ff48665f3ce1f5ca77d73c4b0441b99a0d13e619d973cb5d3434c8e44109080fb09ab2083c0b49687b96c8af13632606efb2d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          96c542dec016d9ec1ecc4dddfcbaac66

                                                                          SHA1

                                                                          6199f7648bb744efa58acf7b96fee85d938389e4

                                                                          SHA256

                                                                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                          SHA512

                                                                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018583001\445a30578f.exe
                                                                          Filesize

                                                                          4.2MB

                                                                          MD5

                                                                          3a425626cbd40345f5b8dddd6b2b9efa

                                                                          SHA1

                                                                          7b50e108e293e54c15dce816552356f424eea97a

                                                                          SHA256

                                                                          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                                                                          SHA512

                                                                          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018585001\d365ae36cf.exe
                                                                          Filesize

                                                                          21KB

                                                                          MD5

                                                                          14becdf1e2402e9aa6c2be0e6167041e

                                                                          SHA1

                                                                          72cbbae6878f5e06060a0038b25ede93b445f0df

                                                                          SHA256

                                                                          7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                                                                          SHA512

                                                                          16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018586001\KDLBJP7.exe
                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          27c1f96d7e1b72b6817b6efeff037f90

                                                                          SHA1

                                                                          2972cc112fc7e20cbf5952abe07407b8c1fbb2a2

                                                                          SHA256

                                                                          aec3ec473de321d123e939985579227ee62b53b3b3edb7ab96e2a66c17e9696d

                                                                          SHA512

                                                                          9a31dc9945889d35aea8710df2f42806c72c422b7b5f4aa8acba6986cbd9ea6a49181a41a50ee21ccbed86cbff87c98a742e681ac3f6a87e2bd4436c9112eb32

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018587001\1ac17ce294.exe
                                                                          Filesize

                                                                          3.1MB

                                                                          MD5

                                                                          c00a67d527ef38dc6f49d0ad7f13b393

                                                                          SHA1

                                                                          7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                                                                          SHA256

                                                                          12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                                                                          SHA512

                                                                          9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018589001\c5cafc2c1f.exe
                                                                          Filesize

                                                                          758KB

                                                                          MD5

                                                                          afd936e441bf5cbdb858e96833cc6ed3

                                                                          SHA1

                                                                          3491edd8c7caf9ae169e21fb58bccd29d95aefef

                                                                          SHA256

                                                                          c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                                                                          SHA512

                                                                          928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018590001\7e72273cde.exe
                                                                          Filesize

                                                                          4.2MB

                                                                          MD5

                                                                          7e467a1f5f56ccec6f54a2eadd37986e

                                                                          SHA1

                                                                          426d5026d97aa82176c37fb6dfa90b0a42b0bfab

                                                                          SHA256

                                                                          11b8f5c194882d807a554abc6614b55cbbd45ca2370ed7cad82509653ccd39ce

                                                                          SHA512

                                                                          699b0ee82a3487c4b389cd64090c5491918113efa7515649957077c6fb04e03f525a81008ce42c8fa7df52321977f06e6fe77f38cb4bad22d222247ddecf614a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018591001\8e8aab79c6.exe
                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          25fb9c54265bbacc7a055174479f0b70

                                                                          SHA1

                                                                          4af069a2ec874703a7e29023d23a1ada491b584e

                                                                          SHA256

                                                                          552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                                                                          SHA512

                                                                          7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018592001\cafaa1f1b4.exe
                                                                          Filesize

                                                                          791KB

                                                                          MD5

                                                                          e8af4d0d0b47ac68d762b7f288ae8e6e

                                                                          SHA1

                                                                          1d65f31526cc20ab41d6b1625d6674d7f13e326c

                                                                          SHA256

                                                                          b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

                                                                          SHA512

                                                                          80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018593001\6100e0f086.exe
                                                                          Filesize

                                                                          1.3MB

                                                                          MD5

                                                                          669ed3665495a4a52029ff680ec8eba9

                                                                          SHA1

                                                                          7785e285365a141e307931ca4c4ef00b7ecc8986

                                                                          SHA256

                                                                          2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                                                                          SHA512

                                                                          bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018594001\52827e2f8a.exe
                                                                          Filesize

                                                                          21KB

                                                                          MD5

                                                                          04f57c6fb2b2cd8dcc4b38e4a93d4366

                                                                          SHA1

                                                                          61770495aa18d480f70b654d1f57998e5bd8c885

                                                                          SHA256

                                                                          51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                                                                          SHA512

                                                                          53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018595001\d073916cb2.exe
                                                                          Filesize

                                                                          1.1MB

                                                                          MD5

                                                                          ef08a45833a7d881c90ded1952f96cb4

                                                                          SHA1

                                                                          f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                                                                          SHA256

                                                                          33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                                                                          SHA512

                                                                          74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018596001\a03a07069a.exe
                                                                          Filesize

                                                                          4.3MB

                                                                          MD5

                                                                          173a79d723cfc3416a2e27d1038cd7f0

                                                                          SHA1

                                                                          0123a7e3ba9e11ce1d0a29a1f0d23f1323ee1947

                                                                          SHA256

                                                                          c072914cc446ecb921c160f822136357722c0e7ab0b7acea7669deaa62557481

                                                                          SHA512

                                                                          53512738684f06cce70782e359aae3761a62a5c8cd4346409114b7e57e1af5874124bfe25205375129fc4bbec1b1ecea0913d98b84432f92cc8becffaf5a47c1

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018597001\f338ce48f7.exe
                                                                          Filesize

                                                                          1.9MB

                                                                          MD5

                                                                          cab7af24073c5c1c62a2957dd5983c98

                                                                          SHA1

                                                                          a41a42e84999503cf76b04edefe3c37f87023285

                                                                          SHA256

                                                                          83709123b921be43ef4f8bcab88738b7e3f6b810fb443da8f447a287fa5d86ae

                                                                          SHA512

                                                                          ab369b7290203e5fbbaa67a84fcac6325d1460e5696a8d6c54595cf85a1e63b5fb513e5bc8bc5fdf17dce02431c2368a5faefeee131c879085a340844734c6e8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018598001\c59e7ff124.exe
                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          6a9681c4e4484e33a9d20e53ff87c490

                                                                          SHA1

                                                                          0bb12b650db680e90659a10decd7a8ec1cd0c12e

                                                                          SHA256

                                                                          555680332dd607bb1c50b8de42292a2ab33f23ea7a0a08318083daf5795d291d

                                                                          SHA512

                                                                          55438f82b36f372a30c2c455cbb9637072935e01625b15397801e2446258a00b3562b0c615e93b0a0ad48a4cb0c52b40575931ae4a611de02aeeb63293ec12e2

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018599001\274a85bb78.exe
                                                                          Filesize

                                                                          2.7MB

                                                                          MD5

                                                                          a2e7bea4344fd57b09e917ba50ecd482

                                                                          SHA1

                                                                          70d3de6bb6f8f19c4b500c3190b307c21259d2af

                                                                          SHA256

                                                                          5008900485671d1e697b9afb70829eaa472b379f94e925394ad7b5ab681bdf3e

                                                                          SHA512

                                                                          9f12fd0c2f92be564f27084bb1c765d5c0dc92eb9f929e60e2e19fb8bbe9d44c262515c0bf81d2191f5ebdd94edaba6e9042c08af75281193fd3dbfd7d8859dc

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018600001\005db8ef2b.exe
                                                                          Filesize

                                                                          950KB

                                                                          MD5

                                                                          b52534323c512593440d4fe90e5d1ee3

                                                                          SHA1

                                                                          ce07ab388eb49acc5e5abfc06ae7e1f0deafa8b6

                                                                          SHA256

                                                                          ab3347c3ae7395ac36f746bf8359c4d66ac7f3d195623c90151a01718dafcffe

                                                                          SHA512

                                                                          1fc4541d74c36b35c48027679e82250a3ba3da2deb29e98ed2bf529844708da9de6103f5e96e0a4427c1b678027e899cc235d015957d5743e500b2fe7ccb40ba

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018601001\8ab40ab135.exe
                                                                          Filesize

                                                                          2.7MB

                                                                          MD5

                                                                          880df76d424516c612b54407aeefa341

                                                                          SHA1

                                                                          5fc31b30425cf3ac3c8f1b947bf4b279d3da0d71

                                                                          SHA256

                                                                          34cda3da6114d02b343d247365e79c33e2fc17409391c42cc187862c21a47321

                                                                          SHA512

                                                                          6191287acb49e638fa22f181e219c70f735e8dadcc53c3aa2578dcae44396a13a22d2ea97a13e0d453a6d4f689418b3105da0302ab06d69c0bdc9a7dd5593e31

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\1018602001\5bdc8c17f9.exe
                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          ff279f4e5b1c6fbda804d2437c2dbdc8

                                                                          SHA1

                                                                          2feb3762c877a5ae3ca60eeebc37003ad0844245

                                                                          SHA256

                                                                          e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                                                                          SHA512

                                                                          c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\Tmp7AD8.tmp
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          a10f31fa140f2608ff150125f3687920

                                                                          SHA1

                                                                          ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

                                                                          SHA256

                                                                          28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

                                                                          SHA512

                                                                          cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zw1fddtc.sce.ps1
                                                                          Filesize

                                                                          60B

                                                                          MD5

                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                          SHA1

                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                          SHA256

                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                          SHA512

                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                          Filesize

                                                                          2.9MB

                                                                          MD5

                                                                          9765ac8d5874ba1323875aa901871db6

                                                                          SHA1

                                                                          376dcb324421e41140e2ff169c2e3f2c39625fe1

                                                                          SHA256

                                                                          d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099

                                                                          SHA512

                                                                          e3b56ccdb50d10de0bedf9067d2d19e16c01feb0116bfa429f9c027dd1c58261f104fceb64ea1bccb04b3f6cde2089431e6f7a2bf863bae6d7eb0163e761aac3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                                                                          Filesize

                                                                          1.6MB

                                                                          MD5

                                                                          72491c7b87a7c2dd350b727444f13bb4

                                                                          SHA1

                                                                          1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                          SHA256

                                                                          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                          SHA512

                                                                          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                          Filesize

                                                                          458KB

                                                                          MD5

                                                                          619f7135621b50fd1900ff24aade1524

                                                                          SHA1

                                                                          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                          SHA256

                                                                          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                          SHA512

                                                                          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
                                                                          Filesize

                                                                          2.2MB

                                                                          MD5

                                                                          579a63bebccbacab8f14132f9fc31b89

                                                                          SHA1

                                                                          fca8a51077d352741a9c1ff8a493064ef5052f27

                                                                          SHA256

                                                                          0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

                                                                          SHA512

                                                                          4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          5659eba6a774f9d5322f249ad989114a

                                                                          SHA1

                                                                          4bfb12aa98a1dc2206baa0ac611877b815810e4c

                                                                          SHA256

                                                                          e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

                                                                          SHA512

                                                                          f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          5404286ec7853897b3ba00adf824d6c1

                                                                          SHA1

                                                                          39e543e08b34311b82f6e909e1e67e2f4afec551

                                                                          SHA256

                                                                          ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

                                                                          SHA512

                                                                          c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          5eb39ba3698c99891a6b6eb036cfb653

                                                                          SHA1

                                                                          d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

                                                                          SHA256

                                                                          e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

                                                                          SHA512

                                                                          6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          7187cc2643affab4ca29d92251c96dee

                                                                          SHA1

                                                                          ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                                                                          SHA256

                                                                          c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                                                                          SHA512

                                                                          27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          b7d1e04629bec112923446fda5391731

                                                                          SHA1

                                                                          814055286f963ddaa5bf3019821cb8a565b56cb8

                                                                          SHA256

                                                                          4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                                                                          SHA512

                                                                          79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          0dc4014facf82aa027904c1be1d403c1

                                                                          SHA1

                                                                          5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                                                                          SHA256

                                                                          a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                                                                          SHA512

                                                                          cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                                                                          Filesize

                                                                          3.3MB

                                                                          MD5

                                                                          cea368fc334a9aec1ecff4b15612e5b0

                                                                          SHA1

                                                                          493d23f72731bb570d904014ffdacbba2334ce26

                                                                          SHA256

                                                                          07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                                                                          SHA512

                                                                          bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\in.exe
                                                                          Filesize

                                                                          1.7MB

                                                                          MD5

                                                                          83d75087c9bf6e4f07c36e550731ccde

                                                                          SHA1

                                                                          d5ff596961cce5f03f842cfd8f27dde6f124e3ae

                                                                          SHA256

                                                                          46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

                                                                          SHA512

                                                                          044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                                                                          Filesize

                                                                          3.3MB

                                                                          MD5

                                                                          045b0a3d5be6f10ddf19ae6d92dfdd70

                                                                          SHA1

                                                                          0387715b6681d7097d372cd0005b664f76c933c7

                                                                          SHA256

                                                                          94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                                                                          SHA512

                                                                          58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                                                                          Filesize

                                                                          440B

                                                                          MD5

                                                                          3626532127e3066df98e34c3d56a1869

                                                                          SHA1

                                                                          5fa7102f02615afde4efd4ed091744e842c63f78

                                                                          SHA256

                                                                          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                                                                          SHA512

                                                                          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                          Filesize

                                                                          479KB

                                                                          MD5

                                                                          09372174e83dbbf696ee732fd2e875bb

                                                                          SHA1

                                                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                          SHA256

                                                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                          SHA512

                                                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                          Filesize

                                                                          13.8MB

                                                                          MD5

                                                                          0a8747a2ac9ac08ae9508f36c6d75692

                                                                          SHA1

                                                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                          SHA256

                                                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                          SHA512

                                                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          ca3d7b8eaa8cc9dc1bd0445cf3a52bb8

                                                                          SHA1

                                                                          84635596867e1fa1262877b95b99829621c34f17

                                                                          SHA256

                                                                          275e794dcb3aab84da1cf1902ff6283aeef53610c5e0d97c91af98e613c87aba

                                                                          SHA512

                                                                          b49193adecd6787c821e4e268fa6bc27d98345bb66952253f7e2124b65bddbb3f32c2131b9198ed6047b493c185ec0fd0e547a2ee74e96a9ab5ef9d3b00e5c5e

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                                                          Filesize

                                                                          8KB

                                                                          MD5

                                                                          086f3d8b40f0f9fd21eabadf7b6091e9

                                                                          SHA1

                                                                          f640018df40607a22c9d71e34ea7d34db55e3757

                                                                          SHA256

                                                                          354444a5a1fe0e1e0582847f513bfdb04ed499ad274025f6b5e8952925c7e3b2

                                                                          SHA512

                                                                          82bf98ef95f60d58f4c405c50883654f4c49fc041cd0be3fa96d80b5904261e7a1c19c1f1fedaae82812b487065a490c9c0c5640dbf0e513a72f46ea4cacb92d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          53729e3d79521e439a5a3491dfc5bfc0

                                                                          SHA1

                                                                          6716a37aeee863511dd848d0621bdca248415bc5

                                                                          SHA256

                                                                          646ae83418a81d17168efd6911e0fda5e4b6f2fb3c2b4e040ffba0f118b18a51

                                                                          SHA512

                                                                          86c97311cc580d4802796586f29d6e801ced619661991aaf2958c2d2439984a6bfb5926cb1507613f08c7952e69ea21a41eae1c5e3d0fb37b36401e8a72af13c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                                                          Filesize

                                                                          5KB

                                                                          MD5

                                                                          6ab0f30ba24ca3edbf404517d9f8eb39

                                                                          SHA1

                                                                          6748b87a4554983091fb5f139293bc1d2bda8ff2

                                                                          SHA256

                                                                          5b3efd06b84e9f977d8be35f3305f05103a0f0cc6de6352fa5466a7a569a096a

                                                                          SHA512

                                                                          64ecb97523b66318f9d8ca44ec7cfe54790d802bc650eeca395f964c0f99293974ec9753223fff61b181628110272f9956b5a2d8840d2b2b1544e93338c766c7

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                                                          Filesize

                                                                          6KB

                                                                          MD5

                                                                          c84449a2153d3ee28e9c508c302a9bce

                                                                          SHA1

                                                                          9351c79d407b9a42cc87d8b85aa00bf52b5302d1

                                                                          SHA256

                                                                          70cabfd1cbe6b50cb369463aef50f342823d170d4a8672c402d5b3bf878fa07c

                                                                          SHA512

                                                                          b4aa22b84c894c7889d287d07281cc312da9aa33910a45a2a8c58191ff06a5f8c10c426b2263c5d14187e704cb2d756e54fb03e45b1bdf5f4327146d221d5bc8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          5617f2a030929040d6fc53b7be451ccd

                                                                          SHA1

                                                                          e4eb3308711c09cc0905e5f4fd9e40df6b9ac8ff

                                                                          SHA256

                                                                          71b7a150ae7a4e19276bf23a31591e7bdfd8ce23b9cdd9f7febc1b7f079df6f2

                                                                          SHA512

                                                                          3a34ae0ce5be5dedbc0f0cf74ca7112f3d31096f8b53fece92e29f0da3037298ef7c8ffe53af82440308f2d3e545c01212943512513c077ccd2d9920ac43d7e8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp
                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          b405067fb4566e62e03a295080158a96

                                                                          SHA1

                                                                          c2a3fdcf50f392ca1e2e63cc21898c03e4f25455

                                                                          SHA256

                                                                          47eb5a36096a4455b87a676c72508b18f3f9eb0d243e31f6a25010949565e2bf

                                                                          SHA512

                                                                          25ad0fd5ef91739ff59ad2875a30f84fda39999f0b4eaa488623d8d219af224e3a7092e470a22924042957ec783436caee6aa23ff33849a38710511a1c80e5f3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\0c81d5fe-1f3b-468f-acc2-bba8352ac612
                                                                          Filesize

                                                                          25KB

                                                                          MD5

                                                                          a5d6c9d94aa5025579b20df339bbff0e

                                                                          SHA1

                                                                          7eae74f0c93653d94867e5102946ed24be278d8d

                                                                          SHA256

                                                                          5c866c2843ecf0d0173ff54444ba217badf954d00496de97f038ca69159b6666

                                                                          SHA512

                                                                          19eff80b98070e8fa38c924747344aae192e55c0398ba35b2133478ef37d4df07d27ee2b6e9afa9ed732836f8e69bbeab59794edd3429e7afc671abd4de94a42

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\afc455c9-b270-4755-a108-ae62b6679a4e
                                                                          Filesize

                                                                          671B

                                                                          MD5

                                                                          52593f83cc7b5c46b5e48e7a06c25e96

                                                                          SHA1

                                                                          b829d7f1e698ca2159bdfb92829c8c8ba889f6cc

                                                                          SHA256

                                                                          140fa953b3d694189570f094023a8a711301257a5cd2f19093baecfd7a21a09c

                                                                          SHA512

                                                                          400e0710804c008837ed99644d194715fac27bdcf3fd26695e26d78e66b7788baa105ad60cf1623867cbf23a3959dd402dea133f245c49cd414a4c123a604213

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\c813eb3f-65eb-4d64-bf55-7cef09f854b3
                                                                          Filesize

                                                                          982B

                                                                          MD5

                                                                          c883c1bf5dae0b1e1bdbdd82a011bdee

                                                                          SHA1

                                                                          3daf9adbb0197b924cdbcb4f375f6a589cb7f020

                                                                          SHA256

                                                                          6d49e4c5064a7a43ae3bf1d74e0ce8fbf27ea35281f7423b2dcf805e61b2e9b6

                                                                          SHA512

                                                                          9830aebc3b1586c2a4c9a3628e4932bcbda5a49b19a7118bd812ba230b0cb524e2fe611fe8326345d1378353b32df8da9437f4008aefc1a333c2892d3134140a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                                          Filesize

                                                                          1.1MB

                                                                          MD5

                                                                          842039753bf41fa5e11b3a1383061a87

                                                                          SHA1

                                                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                          SHA256

                                                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                          SHA512

                                                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                                          Filesize

                                                                          116B

                                                                          MD5

                                                                          2a461e9eb87fd1955cea740a3444ee7a

                                                                          SHA1

                                                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                          SHA256

                                                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                          SHA512

                                                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                                          Filesize

                                                                          372B

                                                                          MD5

                                                                          bf957ad58b55f64219ab3f793e374316

                                                                          SHA1

                                                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                          SHA256

                                                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                          SHA512

                                                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                                          Filesize

                                                                          17.8MB

                                                                          MD5

                                                                          daf7ef3acccab478aaa7d6dc1c60f865

                                                                          SHA1

                                                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                          SHA256

                                                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                          SHA512

                                                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js
                                                                          Filesize

                                                                          12KB

                                                                          MD5

                                                                          f24d351f184a78af36d75593d3c63d61

                                                                          SHA1

                                                                          aa78c173b47c6db024e46766a19d08d00557af86

                                                                          SHA256

                                                                          4b507fa528d600ed21afe6f9748efecd64c718e7021b5bdad3f496e2b860ae97

                                                                          SHA512

                                                                          cd91f3e39d05d0a8a46f63a28fc1aaece7e05dc956a7b65d7f41365a2bab9aa07da973a49fdf869f2ae1e6e04322d1b48e0b9f17fb715a51ca2486500328ea50

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          4748b36ec7aa8d24e5dd5d6d2beddaf1

                                                                          SHA1

                                                                          e387e98f3b9cf54adf7e92c67d45374101c960b9

                                                                          SHA256

                                                                          f9b4ce869a84c4b8562f3e763e499931c6c05ee4ee1b24e4dbbd1037a59af41f

                                                                          SHA512

                                                                          73380eb3a5aff5e8ff806cc2d5bd37f2a978309e3b62bdbf477e7b435815a41cfaefb7eb2ea58207077ea0992dc2ea3771242a1b0d531ea6ee47625c50d9632c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          ad757cc875801be79e7d9a40c1c159ea

                                                                          SHA1

                                                                          1b396f86a5ff5c255b37f69b6e621e4afef8907d

                                                                          SHA256

                                                                          e36479850816622ca6a33be1fc73b8efe42808522ac78e5ea964c77f20a5477e

                                                                          SHA512

                                                                          e37a7563968f5cbb7080c1757b6b7df3b49b4721189995675ed16dbc91d29a9227bf5a3b3b37c8da6c049fe1ed7dc0e7751069a7d7cf4fef2de4d6d035db09a3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                          Filesize

                                                                          2.4MB

                                                                          MD5

                                                                          a507f83b9accd068c455bec85333bcf1

                                                                          SHA1

                                                                          15ced428ad965daadd286e9447a0a5219d18c063

                                                                          SHA256

                                                                          1d03876a26ee1815df2f75283e8b08344a9dad57ce558bc606480fd7c4053111

                                                                          SHA512

                                                                          3e1c199a03e86cf4e2ea5eef6b02d729b4997aa450b70381365120b2e2c0e9513d6dae89beddf16eac5f3892b439d74ac806860c2535c986738655e6e9e63d1c

                                                                          Download Submit

                                                                        • C:\vmpqsiis\e0fcd0b83d9544c69076ef29ebbbc415.exe
                                                                          Filesize

                                                                          1.2MB

                                                                          MD5

                                                                          577cd52217da6d7163cea46bb01c107f

                                                                          SHA1

                                                                          82b31cc52c538238e63bdfc22d1ea306ea0b852a

                                                                          SHA256

                                                                          139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

                                                                          SHA512

                                                                          8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

                                                                          Download Submit

                                                                        • C:\zmlrex\22ab9842b6a4427893bf613fb528ada9.exe
                                                                          Filesize

                                                                          1.0MB

                                                                          MD5

                                                                          971b0519b1c0461db6700610e5e9ca8e

                                                                          SHA1

                                                                          9a262218310f976aaf837e54b4842e53e73be088

                                                                          SHA256

                                                                          47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

                                                                          SHA512

                                                                          d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

                                                                          Download Submit

                                                                        • C:\zmlrex\b3082ead54864e6baf8791ac47ef47bb.exe
                                                                          Filesize

                                                                          144KB

                                                                          MD5

                                                                          cc36e2a5a3c64941a79c31ca320e9797

                                                                          SHA1

                                                                          50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

                                                                          SHA256

                                                                          6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

                                                                          SHA512

                                                                          fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

                                                                          Download Submit

                                                                        • memory/208-20-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-16-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-563-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-300-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-19-0x0000000000081000-0x00000000000AF000-memory.dmp

                                                                          Filesize

                                                                          184KB

                                                                          Download

                                                                        • memory/208-257-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-21-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-22-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-441-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-41-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-48-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-873-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-84-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-86-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-369-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/208-355-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/220-214-0x000000006F420000-0x000000006F46C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/400-153-0x00000188ED020000-0x00000188ED042000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/412-429-0x0000000000930000-0x000000000093C000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/556-178-0x00000000004D0000-0x000000000096A000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/556-229-0x00000000004D0000-0x000000000096A000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/640-476-0x00000000077D0000-0x00000000077F6000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                          Download

                                                                        • memory/640-698-0x00000000055B0000-0x0000000005672000-memory.dmp

                                                                          Filesize

                                                                          776KB

                                                                          Download

                                                                        • memory/640-464-0x0000000004AB0000-0x0000000004ABA000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/640-463-0x00000000075F0000-0x0000000007682000-memory.dmp

                                                                          Filesize

                                                                          584KB

                                                                          Download

                                                                        • memory/640-462-0x0000000000760000-0x0000000000876000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/1288-383-0x00007FF7034C0000-0x00007FF703950000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/1288-370-0x00007FF7034C0000-0x00007FF703950000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/1512-588-0x0000000000400000-0x0000000000639000-memory.dmp

                                                                          Filesize

                                                                          2.2MB

                                                                          Download

                                                                        • memory/1512-510-0x0000000000400000-0x0000000000639000-memory.dmp

                                                                          Filesize

                                                                          2.2MB

                                                                          Download

                                                                        • memory/1520-248-0x0000000000210000-0x0000000000538000-memory.dmp

                                                                          Filesize

                                                                          3.2MB

                                                                          Download

                                                                        • memory/1520-361-0x0000000005150000-0x00000000052A6000-memory.dmp

                                                                          Filesize

                                                                          1.3MB

                                                                          Download

                                                                        • memory/1520-362-0x0000000005850000-0x0000000005DF4000-memory.dmp

                                                                          Filesize

                                                                          5.6MB

                                                                          Download

                                                                        • memory/1520-363-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/1520-249-0x0000000004E00000-0x0000000004E9C000-memory.dmp

                                                                          Filesize

                                                                          624KB

                                                                          Download

                                                                        • memory/1728-295-0x00000000000F0000-0x000000000058A000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/1728-276-0x00000000000F0000-0x000000000058A000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/1856-4-0x0000000000630000-0x000000000094B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/1856-0-0x0000000000630000-0x000000000094B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/1856-1-0x00000000771B4000-0x00000000771B6000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/1856-18-0x0000000000630000-0x000000000094B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/1856-2-0x0000000000631000-0x000000000065F000-memory.dmp

                                                                          Filesize

                                                                          184KB

                                                                          Download

                                                                        • memory/1856-3-0x0000000000630000-0x000000000094B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/1876-259-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

                                                                          Filesize

                                                                          3.7MB

                                                                          Download

                                                                        • memory/1876-278-0x0000000000AE0000-0x0000000000E9B000-memory.dmp

                                                                          Filesize

                                                                          3.7MB

                                                                          Download

                                                                        • memory/2600-500-0x0000000000F90000-0x00000000010E7000-memory.dmp

                                                                          Filesize

                                                                          1.3MB

                                                                          Download

                                                                        • memory/2600-450-0x0000000000F00000-0x0000000000F56000-memory.dmp

                                                                          Filesize

                                                                          344KB

                                                                          Download

                                                                        • memory/2736-349-0x0000000000980000-0x0000000000E2B000-memory.dmp

                                                                          Filesize

                                                                          4.7MB

                                                                          Download

                                                                        • memory/2736-331-0x0000000000980000-0x0000000000E2B000-memory.dmp

                                                                          Filesize

                                                                          4.7MB

                                                                          Download

                                                                        • memory/2784-773-0x00000000001F0000-0x0000000000E6F000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/2784-746-0x00000000001F0000-0x0000000000E6F000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/2784-2976-0x00000000001F0000-0x0000000000E6F000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/2784-556-0x00000000001F0000-0x0000000000E6F000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/3484-199-0x0000000007E30000-0x0000000007E4A000-memory.dmp

                                                                          Filesize

                                                                          104KB

                                                                          Download

                                                                        • memory/3484-196-0x0000000007CF0000-0x0000000007D01000-memory.dmp

                                                                          Filesize

                                                                          68KB

                                                                          Download

                                                                        • memory/3484-130-0x0000000002EC0000-0x0000000002EF6000-memory.dmp

                                                                          Filesize

                                                                          216KB

                                                                          Download

                                                                        • memory/3484-131-0x0000000005B00000-0x0000000006128000-memory.dmp

                                                                          Filesize

                                                                          6.2MB

                                                                          Download

                                                                        • memory/3484-140-0x0000000006210000-0x0000000006564000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                          Download

                                                                        • memory/3484-136-0x00000000061A0000-0x0000000006206000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/3484-135-0x0000000006130000-0x0000000006196000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/3484-151-0x00000000067D0000-0x00000000067EE000-memory.dmp

                                                                          Filesize

                                                                          120KB

                                                                          Download

                                                                        • memory/3484-152-0x00000000067F0000-0x000000000683C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/3484-132-0x0000000005740000-0x0000000005762000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/3484-179-0x0000000006DA0000-0x0000000006DD2000-memory.dmp

                                                                          Filesize

                                                                          200KB

                                                                          Download

                                                                        • memory/3484-200-0x0000000007E10000-0x0000000007E18000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/3484-198-0x0000000007D30000-0x0000000007D44000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                          Download

                                                                        • memory/3484-197-0x0000000007D20000-0x0000000007D2E000-memory.dmp

                                                                          Filesize

                                                                          56KB

                                                                          Download

                                                                        • memory/3484-195-0x0000000007D70000-0x0000000007E06000-memory.dmp

                                                                          Filesize

                                                                          600KB

                                                                          Download

                                                                        • memory/3484-194-0x0000000007B60000-0x0000000007B6A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/3484-193-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

                                                                          Filesize

                                                                          104KB

                                                                          Download

                                                                        • memory/3484-192-0x0000000008140000-0x00000000087BA000-memory.dmp

                                                                          Filesize

                                                                          6.5MB

                                                                          Download

                                                                        • memory/3484-191-0x00000000077A0000-0x0000000007843000-memory.dmp

                                                                          Filesize

                                                                          652KB

                                                                          Download

                                                                        • memory/3484-190-0x0000000006D80000-0x0000000006D9E000-memory.dmp

                                                                          Filesize

                                                                          120KB

                                                                          Download

                                                                        • memory/3484-180-0x000000006F420000-0x000000006F46C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/3572-354-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                          Filesize

                                                                          340KB

                                                                          Download

                                                                        • memory/3572-352-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                          Filesize

                                                                          340KB

                                                                          Download

                                                                        • memory/3844-297-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                          Filesize

                                                                          344KB

                                                                          Download

                                                                        • memory/3844-299-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                          Filesize

                                                                          344KB

                                                                          Download

                                                                        • memory/3900-477-0x00000000073B0000-0x00000000073C1000-memory.dmp

                                                                          Filesize

                                                                          68KB

                                                                          Download

                                                                        • memory/3900-478-0x00000000073F0000-0x0000000007404000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                          Download

                                                                        • memory/3900-475-0x00000000070D0000-0x0000000007173000-memory.dmp

                                                                          Filesize

                                                                          652KB

                                                                          Download

                                                                        • memory/3900-465-0x000000006F420000-0x000000006F46C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/3900-440-0x0000000005880000-0x0000000005BD4000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                          Download

                                                                        • memory/4284-489-0x0000000005590000-0x00000000058E4000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                          Download

                                                                        • memory/4284-490-0x000000006F420000-0x000000006F46C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/4284-501-0x00000000070A0000-0x00000000070B4000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                          Download

                                                                        • memory/4284-359-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/4284-360-0x0000000000080000-0x000000000039B000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/4312-2967-0x0000000000400000-0x0000000000C61000-memory.dmp

                                                                          Filesize

                                                                          8.4MB

                                                                          Download

                                                                        • memory/4312-604-0x0000000000400000-0x0000000000C61000-memory.dmp

                                                                          Filesize

                                                                          8.4MB

                                                                          Download

                                                                        • memory/4312-731-0x0000000010000000-0x000000001001C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/4528-411-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-380-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-381-0x0000000002330000-0x0000000002350000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4528-382-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-371-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-373-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-378-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-377-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-376-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-375-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-374-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4528-372-0x0000000140000000-0x0000000140770000-memory.dmp

                                                                          Filesize

                                                                          7.4MB

                                                                          Download

                                                                        • memory/4652-522-0x00000199C82C0000-0x00000199C837A000-memory.dmp

                                                                          Filesize

                                                                          744KB

                                                                          Download

                                                                        • memory/4652-564-0x00000199CBB20000-0x00000199CBB46000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                          Download

                                                                        • memory/4652-551-0x00000199C8780000-0x00000199C878E000-memory.dmp

                                                                          Filesize

                                                                          56KB

                                                                          Download

                                                                        • memory/4652-550-0x00000199CB5B0000-0x00000199CB5E8000-memory.dmp

                                                                          Filesize

                                                                          224KB

                                                                          Download

                                                                        • memory/4652-555-0x00000199CB960000-0x00000199CBAE6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                          Download

                                                                        • memory/4652-521-0x00000199C6A00000-0x00000199C6A0A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/4652-538-0x00000199C7C20000-0x00000199C7C5C000-memory.dmp

                                                                          Filesize

                                                                          240KB

                                                                          Download

                                                                        • memory/4652-539-0x00000199C8710000-0x00000199C8718000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/4652-519-0x00000199AC4A0000-0x00000199AC5A2000-memory.dmp

                                                                          Filesize

                                                                          1.0MB

                                                                          Download

                                                                        • memory/4652-537-0x00000199C7BC0000-0x00000199C7BD2000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                          Download

                                                                        • memory/4768-139-0x00007FF6D99F0000-0x00007FF6D9E80000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/4768-137-0x00007FF6D99F0000-0x00007FF6D9E80000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/4792-73-0x0000000000C20000-0x0000000000C2C000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/4804-316-0x0000000000BB0000-0x000000000182A000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/4804-356-0x0000000000BB0000-0x000000000182A000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/4804-357-0x0000000000BB0000-0x000000000182A000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/4804-412-0x0000000000BB0000-0x000000000182A000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/4804-402-0x0000000000BB0000-0x000000000182A000-memory.dmp

                                                                          Filesize

                                                                          12.5MB

                                                                          Download

                                                                        • memory/4896-367-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                          Filesize

                                                                          344KB

                                                                          Download

                                                                        • memory/4896-364-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                          Filesize

                                                                          344KB

                                                                          Download

                                                                        • memory/5160-878-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-877-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-2969-0x00000000057E0000-0x000000000582C000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/5160-890-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-888-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-2968-0x0000000005750000-0x000000000577C000-memory.dmp

                                                                          Filesize

                                                                          176KB

                                                                          Download

                                                                        • memory/5160-886-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-884-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-882-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-880-0x0000000005680000-0x0000000005711000-memory.dmp

                                                                          Filesize

                                                                          580KB

                                                                          Download

                                                                        • memory/5160-874-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                          Filesize

                                                                          400KB

                                                                          Download

                                                                        • memory/5160-876-0x0000000005680000-0x0000000005718000-memory.dmp

                                                                          Filesize

                                                                          608KB

                                                                          Download

                                                                        • memory/5172-722-0x0000000000340000-0x00000000007DE000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/5172-791-0x0000000000340000-0x00000000007DE000-memory.dmp

                                                                          Filesize

                                                                          4.6MB

                                                                          Download

                                                                        • memory/7392-3390-0x0000000000AA0000-0x0000000000D58000-memory.dmp

                                                                          Filesize

                                                                          2.7MB

                                                                          Download

                                                                        • memory/7392-3406-0x0000000000AA0000-0x0000000000D58000-memory.dmp

                                                                          Filesize

                                                                          2.7MB

                                                                          Download

                                                                        • memory/7392-3405-0x0000000000AA0000-0x0000000000D58000-memory.dmp

                                                                          Filesize

                                                                          2.7MB

                                                                          Download

                                                                        • memory/8060-2973-0x00000000007D0000-0x0000000000CC3000-memory.dmp

                                                                          Filesize

                                                                          4.9MB

                                                                          Download